The UK Financial Conduct Authority (FCA) has published a blog with findings from its survey of corporate finance firms’ compliance resources and activities. While the FCA identified examples of good practice, it also highlighted areas requiring improvement, emphasising that compliance should not be viewed merely as a series of tasks, but as a culture that senior managers must embed throughout the business.

The key findings were:

• 63% of firms reported having a compliance function that is not dedicated solely to compliance and has other business responsibilities. This can create conflicts of interest, for example where compliance also plays a role in revenue generation.
• Arrangements should be proportionate to the risks involved, but they are only proportionate if they deliver good outcomes. This is particularly important in small firms, where decision-making may be concentrated in a small number of people.
• 90% of respondents used some form of third-party compliance support. However, responsibility for regulatory compliance remains with the relevant senior management function holder, and firms must maintain effective oversight of any third-party support.
• 47% of firms carried out all the activities covered by the survey. The wider gaps related to whistleblowing arrangements, breach registers, monitoring complaints, reporting to management and involving compliance in management meetings. The most common gap was failing to include regulatory compliance in staff performance assessments, reported by 140 firms.

The FCA expects firms to use these findings to reflect on their own arrangements and identify where improvement is needed.

The European Securities and Markets Authority (ESMA) has published an opinion setting out its supervisory expectations for crypto-asset services involving asset-referenced tokens (ARTs) and e-money tokens (EMTs) that do not comply with the Markets in Crypto-Assets Regulation (MiCAR).

ESMA states that MiCAR-authorised crypto-asset service providers (CASPs) should not provide services in relation to non-compliant ARTs or EMTs. This applies to services including the operation of trading platforms, exchange services, execution of orders, placing of crypto-assets, reception and transmission of orders, investment advice, transfers, custody and administration, and portfolio management, whether provided on a standalone basis or in combination. ESMA further considers that reliance on warnings, disclosures or client acknowledgements would not sufficiently address the concerns identified in the opinion.

The opinion also calls on national competent authorities to ensure that CASPs do not maintain, introduce or facilitate access to such tokens, and that appropriate technical, contractual and organisational controls are in place to prevent clients from acquiring new or increasing existing exposures. Where pre-existing exposures remain, ESMA expects them to be remediated as soon as possible, and no later than three months after the publication of the opinion (i.e. by 8 January 2027). Any continued provision of services is advised to be strictly limited to activities necessary for the liquidation, conversion, withdrawal, transfer or safekeeping of such assets, and should remain time-limited, risk-based, and closely supervised.

The UK Financial Conduct Authority (FCA) has published consultation paper CP26/35 on fair redemption terms for authorised funds investing in illiquid assets. The proposals apply primarily to non-UCITS retail scheme (NURS) funds invested predominantly in inherently illiquid assets, meaning funds where at least 50% of scheme property is invested in such assets, and that offer regular liquidity.

The FCA proposes the reforms to retail investment fund rules so that a fund’s redemption terms reflect the time it typically takes to sell illiquid assets in the portfolio. Key proposals include:

• broadening the scope of the funds investing in inherently illiquid assets (FIIA) regime by amending the definition of inherently illiquid assets
• limiting the frequency of dealing days (when the fund manager redeems or cancels investors’ units in the fund) to no more than one per month
• minimum 90-day notice periods for redemptions
• aligning the minimum redemption terms with the long-term asset fund (LTAF) regime
• enhancing investor disclosures, including updated risk warnings and prospectus disclosure requirements for funds with limited redemption arrangements
• permitting authorised fund managers (AFMs) of all NURS funds to introduce limited redemption arrangements to align the fund’s redemption terms better with its liquidity profile
• extending deferral powers to all NURS funds operating limited redemption arrangements
• allowing LTAF investors to revoke redemption requests during the notice period if the fund manager is satisfied it would not be unfair to other investors.

The deadline for feedback is 11 December, and final rules are anticipated in H1 2027. The FCA proposes a two-year implementation period for existing NURS funds that would fall within the amended scope of the FIIA regime for the first time. AFMs of these NURS funds newly brought in scope and their depositaries must comply with existing FIIA rules from 1 year after the new rules are made (aside from the risk warning rules).

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has published its response to the European Commission’s (EC) consultation on the review of the Markets in Crypto-Assets Regulation (MiCAR). The targeted consultation sought views on technical and legal issues on whether MiCAR remains fit for purpose in light of evolving market and international developments. AMLA makes recommendations in five areas where targeted amendments or clarifications could help address money laundering and terrorist financing (ML/TF) risks more effectively and support consistent supervision across the EU.

These are:

• Staking, lending and borrowing: AMLA suggests that the EC consider bringing these activities within MiCAR’s regulatory framework, reflecting their specific ML/TF risks.
• Decentralised Finance (DeFi) arrangements: AMLA invites consideration of a clear legal definition and common criteria for identifying who exercises effective control over crypto-asset services or activities through DeFi arrangements.
• Unauthorised stablecoins: AMLA encourages a consistent EU-wide approach that removes legal uncertainty.
• Certain asset-referenced token issuers not considered as obliged entities under the anti-money laundering and countering the financing of terrorism (AML/CFT) framework: AMLA suggests reviewing this interaction, including whether certain token issuers should fall within scope of AML/CFT rules.
• Cross-border supervision of service providers: AMLA sees scope for clearer information requirements to support effective supervision.

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has published a consultation on draft regulatory technical standards (RTS) for a central EU-wide anti-money laundering and countering the financing of terrorism (AML/CFT) database. The database will act as a single platform through which supervisory authorities can report and access information on supervised entities, supervisors and supervisory activities. It is intended to support the exchange of supervisory information across the EU and to make AML/CFT supervision more targeted, risk-based and effective. To keep the reporting burden low, the draft RTS draw primarily on data that supervisors already hold or will collect in any event, so the database should impose no additional reporting costs on obliged entities.

AMLA proposes that supervisory authorities transmit the following information in relation to:

• Supervisory authorities and self-regulatory bodies: their powers and tasks; statistics on resources and staffing; and the supervisory activities they carry out.
• Obliged entities: money laundering and terrorist financing risks; sanctions, administrative measures and periodic penalty payments; and authorisations, withdrawal of authorisations and fit and proper assessments.

The draft RTS also include provisions on measures on data quality, confidentiality and the onward sharing of information contained in the database. AMLA proposes a phased implementation so that supervisors have time to adapt to the new requirements. Stakeholders are invited to give their views at a public hearing on 3 November.

The UK Prudential Regulation Authority (PRA) has published consultation paper CP13/26, proposing a new framework for the automatic indexation of certain regulatory thresholds across the PRA Rulebook, supervisory statements and statements of policy. Under the proposal, eligible fixed monetary thresholds would be updated every five years using UK nominal GDP growth as the indexation metric, with the first update taking effect on 1 July 2031. The PRA states that the framework is intended to address “prudential drag”, where fixed thresholds become more restrictive over time as the economy grows. The criteria and methodology will be set out in a new statement of policy on the PRA’s approach to automatic indexation, a draft of which accompanies the consultation.

The PRA proposes bringing 128 thresholds within scope of the framework (set out in Appendix 3 and Appendix 4 of CP13/26). It also seeks feedback, through a discussion paper, on additional thresholds where the costs and benefits to firms of indexation are less clear to the PRA. These include thresholds relating to internal ratings-based models, liquidity thresholds that interact with credit risk thresholds, and thresholds operating across the PRA and UK Financial Conduct Authority frameworks relating to remuneration, whistleblowing and the Senior Managers and Certification Regime. Appendix 5 sets out the thresholds covered by the discussion chapter. The deadline for responses to both the consultation and the discussion paper is 7 February.

The European Securities and Markets Authority (ESMA) has published a statement on the transitional regime for third-country central securities depositories (CSDs). ESMA notes that, under the Central Securities Depositories Regulation (Regulation 909/2014), third-country CSDs may continue to provide certain notary services to issuers and central maintenance services to participants only until a recognition decision is taken or until 17 January 2027, whichever is earlier. ESMA highlights that the Market Integration and Supervision Package (MISP) proposes to extend this transitional period by a further three years following MISP’s entry into force, and that both the Council of the EU and the European Parliament appear broadly supportive of the extension.

In response to operational concerns raised by market participants, and in light of the emerging consensus among EU co-legislators, ESMA acknowledges that neither it nor national competent authorities (NCAs) can suspend or disapply directly applicable EU legislation, even in exceptional circumstances, and that any formal changes to the applicable regime would require EU legislation. Nonetheless, ESMA expects NCAs not to prioritise supervisory or enforcement action against non-recognised third-country CSDs pending the proposed extension under MISP taking effect.

The UK Financial Conduct Authority (FCA) has announced that it will change how firms submit fund authorisation applications and notifications. Firms currently send these by email, but over the next two to three years the FCA will gradually move to fully digital forms submitted online through Connect. The changes are designed to: improve data quality, regulatory oversight and governance; give more clarity and certainty about FCA expectations; and shorten the time it takes the FCA to reach a decision. The FCA is not expecting to significantly change content requirements for these applications and notifications at this stage.

The changes will be made in phases:

• From 2 November, firms must complete the existing forms for new scheme authorisations (Forms 12, 242 and 261C) and submit them, with supporting documents, via Connect. The same applies to forms to amend or wind up an authorised fund (Forms 21, 251, 261Q, 283A and 9, and the UCITS feeder form) and to final notifications (Form FN). After that date, the FCA will not accept these forms by any other method.
• During December, the FCA plans to move scheme document filings for authorised and recognised funds to Connect. Once this is live, it will no longer accept filings by email.
• In early 2027, certain Alternative Investment Fund Managers Directive applications and notifications will move to Connect.

Until then, firms should keep using the current process and are requested to prepare now by checking that the people who make fund applications or notifications have access to Connect. Where a third party submits on a firm’s behalf, the firm should make sure that third party has the right delegated access in Connect. The FCA’s Connect user guide for fund authorisations gives step-by-step instructions.

The Council of the EU has published a note from the Presidency to the Permanent Representatives Committee (COREPER) on the proposed Market Integration and Supervision Package (MISP), together with compromise texts (dated 2 October) of the three legislative proposals forming part of the package, specifically:

• the text of the proposed Regulation on settlement finality, which would repeal the Settlement Finality Directive (Directive 98/26/EC) and amend the Financial Collateral Directive (Directive 2002/47/EC)
• the text of the proposed Directive amending the Undertakings for Collective Investment in Transferable Securities Directive (UCITS), Alternative Investment Fund Managers Directive (AIFMD) and Markets in Financial Instruments Directive II (MiFID II) frameworks on the further development of capital market integration and supervision within the EU (MISP Directive)
• the text of the proposed Regulation amending a range of existing EU financial services legislation to support the further development of EU capital market integration and supervision within the EU (MISP Regulation).

The note states that the compromise texts largely preserve the original legislative proposals from the European Commission and are now presented for final agreement. There has, however, been some movement of note, particularly in relation to the Regulation of Settlement Finality, which has been amended so that the protections for third-country registered and EU systems are more closely aligned.

The note also explains that the texts intend to strengthen market integration, improve supervisory consistency, expand market transparency, and modernise trading infrastructure while balancing the differing priorities of member states. Further detail on the key elements of the proposals is set out in the Annex. The note also highlights that agreement is still needed on the European Securities and Markets Authority funding arrangements and the definition of significant trading venues before the overall package can be agreed.

An updated Council webpage states that the Economic and Financial Affairs Council is expected to agree its position on the legislative proposals at its meeting on 9 October.

The UK Financial Conduct Authority (FCA) has published consultation paper CP26/34 on guidance to help firms implement the new transaction reporting rules set out in PS26/15. The rules will come into force on 3 April 2028 and form part of a new, streamlined framework that follows HM Treasury’s planned repeal of the UK Markets in Financial Instruments Regulation (MiFIR) transaction reporting legislation.

The consultation also covers:

• the FCA’s approach to carrying across relevant parts of the transaction reporting, instrument reference data and record-keeping related Level 3 materials on its Handbook website into a new transaction reporting user pack
• provisions to give firms clarity on the transition between the current and future transaction reporting regime
• consequential amendments to its Handbook and technical standards to reflect the repeal of the relevant parts of UK MiFIR and technical standards and their replacement by MAR 13, MAR 14 and MAR 15.

The FCA will publish a further consultation on the user pack in Q1 2027, with a final version due by 3 April 2027. As the current “Level 3 materials” section of the FCA’s Handbook does not cover all reporting scenarios, the FCA is also asking where further guidance may be needed, and the responses will help shape the development of additional guidance to be included in the user pack. The deadline for comments on the consultation is 6 November. Alongside the consultation, the FCA published its draft schema and validation rules on the Market Data Processor webpage, to help firms prepare for the implementation of the final rules.

The Basel Committee on Banking Supervision (BCBS) has published the summary of its latest meeting which took place on 28-29 September, in which members discussed a range of analytical, supervisory and regulatory initiatives. In the press release, the BCBS sets out the outcomes of the meeting, including:

• Digitalisation: The BCBS noted that while AI may support greater efficiency and innovation in financial services, it could also increase operational, cyber and concentration risks. It agreed that AI's integration into critical financial functions will require careful governance, robust risk management and ongoing supervisory attention. The Committee also agreed to review the sufficiency and adequacy of existing "event type" loss categories set out in the operational risk framework, with a focus on cyber risk and AI developments. It will continue to monitor AI developments and discuss supervisory implications.
• Pillar 3 disclosures: Following its consultation on machine-readable Pillar 3 disclosures, the BCBS approved a final standard to provide for an innovative and efficient channel of bank disclosures. The final standard will be published around the end of the year.
• Cryptoassets: The Committee is reviewing targeted elements of its prudential standard for banks' exposures to cryptoassets, and expects to provide an update by the end of the year.
• Global systemically important banks (G-SIBs): The BCBS approved the results of the end-2025 assessment exercise under its G-SIBs framework. The results will be submitted to the Financial Stability Board before it publishes the 2026 list of G-SIBs. The BCBS also approved revisions to the G-SIB assessment framework to reduce "window-dressing" behaviour by banks following an earlier consultation. The revisions will be published later this month. In addition, it agreed to publish an update to its methodology for comment on whether to incorporate the treatment of cross-border exposures within the European banking union in the G-SIB framework. The consultation will also be published later this month.
• Interest rate risk in the banking book (IRRBB): The Committee agreed to consult on additional Pillar 2 guidance for banks and supervisors to strengthen implementation of the IRRBB framework. The consultation will be published next month.
• Liquidity: The BCBS is assessing targeted updates to its Principles for Sound Liquidity Risk Management and Supervision, which were published in September 2008. An update on this work will be provided later this year.

The EU Anti-Money Laundering Authority (AMLA) has published final draft regulatory technical standards (RTS) under Article 46(4) of the Sixth Anti-Money Laundering Directive (Directive (EU) 2024/1640) (AMLD 6). The draft RTS were previously consulted on in May and establish a simple, proportionate, and efficient framework for information exchange, cross-border inquiries, and coordinated supervision. In particular, they:

• give supervisors of cross-border groups—in both the financial and non-financial sectors—a shared baseline for working together across the EU
• set out practical arrangements for effective day-to-day cooperation, including a simplified disclosure framework allowing the onward sharing of information among EU supervisors without prior consent
• enable home and host supervisors to conduct cross-border inquiries and coordinate supervisory approaches
• favour a proportionate and risk-based approach to supervisory cooperation.

The final draft RTS will be submitted to the European Commission for adoption before being published in the Official Journal of the European Union (OJ). They are expected to come into force 20 days after being published in the OJ and will apply from 10 July 2027.

The European Banking Authority (EBA) has published its work programme, setting out its key areas of focus and deliverables for 2027. The work programme is structured around three cost-cutting drivers: improving efficiency, fostering resilience and supporting transformation. Key areas of focus include:

• completing the implementation of the EU's 2024 banking package
• implementing the new payment services framework
• supporting crisis management and deposit insurance reforms
• contributing to the Savings and Investments Union (SIU) and the legislative proposals for the revised securitisation framework
• implementing a new supervisory convergence framework
• enhancing stress testing and simulation capacity
• advancing integrated reporting and data sharing
• strengthening internal governance and IT resilience
• continuing work under the Digital Operational Resilience Act (DORA), the Markets in Crypto-Assets Regulation (MiCAR) and the European Market Infrastructure Regulation (EMIR).

The EBA also highlights its commitment to regulatory simplification, proportionality, and reducing unnecessary reporting and compliance burdens, in support of the European Commission's banking competitiveness agenda. Chapter 2 of the work programme provides detailed descriptions of the specific activities that the EBA intends to undertake in 2027, including the timings of those activities.

The Bank of England (BoE) has published the record of the Financial Policy Committee's (FPC) meeting held on 25 September. The headline judgements and policy actions from the meeting include:

• The likelihood of interconnected vulnerabilities in the financial system crystallising has risen since the FPC's previous meeting. The re-escalation of the conflict in the Middle East has renewed uncertainty around growth and the path of interest rates in a number of advanced economies, re-intensifying the risk that vulnerabilities in sovereign debt markets, risky asset valuations, and risky credit markets crystallise at the same time.
• The rapid increase in AI-related debt issuance broadens the exposure of capital markets to developments in AI. In addition, recent frontier AI incidents have heightened concerns about the pace of AI development and related cyber and operational risks. The FPC stresses the importance of managing these increasingly interconnected risks in a timely and prudent manner.
• Risky credit markets, including parts of private credit, remain vulnerable to a tightening in financing conditions. It notes the importance of the private markets system-wide exploratory scenario in filling data gaps.
• Households and corporates remain resilient, and the UK banking system remains appropriately capitalised with high levels of liquidity.
• The FPC has decided to maintain the UK countercyclical capital buffer rate at its neutral setting of 2%.
• The Committee has agreed to proceed with the proposed leverage ratio reforms as set out in the July financial stability in focus report, which the BoE expects to consult on in early 2027. This increases the importance of continuing to develop and implement measures to improve the resilience of the gilt repo market. If, in future, the Committee were to judge that risks were heightened and that additional resilience was warranted, it would consider increasing the general leverage ratio buffer above 25 basis points.
• The most material climate-related channels to UK financial stability are the potential long-run impacts of climate change on sovereign debt pressures globally. The analysis behind this will be published in a forthcoming BoE Insights article.

Separately, the BoE published its systemic risk survey results for H2 2026 to quantify participants' views of risks to, and their confidence in, the stability of the UK financial system.

The European Securities and Markets Authority (ESMA) has responded to the European Commission's consultation on the review of the Markets in Crypto-Assets Regulation (MiCAR). The targeted consultation contained technical and legal questions on whether MiCAR remains fit for purpose in light of evolving market and international developments. ESMA's recommendations aim to simplify the framework while improving investor protection and addressing innovative business models, such as decentralised finance (DeFi), staking, lending, and borrowing. ESMA's proposals include:

• Enhancing investor protection: New safeguards in areas where investors face risks that are not fully covered under the current framework. This includes: (i) stricter rules for the marketing of cryptoassets; (ii) greater transparency in costs; and (iii) proportionate requirements for staking, lending, and borrowing, including through disclosure obligations.
• Reinforcing supervision: Strengthening supervisory powers and addressing the risks arising from unauthorised services, online fraud, and non-compliant stablecoins by: (i) enhancing the EU's capacity to detect, block and deactivate fraudulent websites and freeze cryptoassets in cases of suspicion of market abuse or terrorist financing; (ii) obtaining reinforced supervisory powers to deal with third-country firms which solicit EU investors without being authorised under MiCAR; and (iii) introducing explicit rules to prevent regulated crypto firms from offering services linked to stablecoins that do not comply with MiCAR requirements.
• Evolving towards DeFi and improving cryptoasset classification: Introducing clearer criteria for identifying which activities can be considered genuinely decentralised, as activity around DeFi and stablecoins evolves. It also proposes a new regulated cryptoasset service for firms that provide users with access to DeFi protocols, adopting rules on how cryptoassets should be classified (including hybrid tokens), and granting powers to ESMA to issue binding opinions on token classification to promote the consistent treatment of products across the EU.
• Simplification and burden reduction: Streamlining parts of the existing rules, including simplifying cryptoasset white-paper notification procedures, reducing duplicative authorisation requirements for some regulated firms, and improving the consistency of prudential requirements.

Beyond the immediate MiCAR review, ESMA also highlights the need for a framework for tokenised securities and on-chain settlement that can support the development of an integrated European tokenised capital market and facilitate cross-border activity in the future.

The UK Financial Conduct Authority (FCA) has published Primary Market Bulletin 66 (PMB 66) covering developments relevant to primary market participants. The bulletin finalises technical note (TN) 619.3, which contains guidelines on disclosure requirements under the Prospectus Rules: Admission to Trading on a Regulated Market (PRM) and guidance on specialist issuers. It also makes consequential amendments to TN 321.5 on working capital statements and risk factors, following consultation in PMB 63. The updated guidelines aim to provide flexibility so that a clean working capital statement may be given where directors judge that certain uncommitted facilities can be considered available for the entirety of the working capital period, with appropriate disclosure alongside the working capital statement in the prospectus.

In PMB 66, the FCA also consults on a new proposed TN 803.1, which will set out the FCA's expectations for issuers under the new sustainability disclosure requirements and replace the existing UK Listing Rules guidance in TN 801.4. The rest of TN 801.4 will remain in force. TN 803.1 will also replace TN 802.3 in full. The deadline for responses is 28 October, and the FCA intends to finalise the guidance before the new rules take effect in January 2027. The FCA also sets out a list of its expectations to help listed companies prepare for the new requirements. Further details of the final sustainability disclosure rules are covered separately here.

PMB 66 also sets out the FCA's observations on disclosing inside information relating to cyber incidents. These were drawn from discussions the FCA held with issuers and their advisers. The FCA's observations also address disclosures relating to the discovery of historical systems compromise, delaying disclosure, making subsequent disclosures, and sharing inside information with authorities. For more detail, you may wish to read our blog post titled "When a cyber incident becomes inside information – new observations from the UK FCA".

The UK Financial Conduct Authority (FCA) has published finalised non-Handbook guidance relating to the overall risk assessment requirements under the new prudential framework for regulated cryptoasset firms. This includes:

• Non-Handbook guidance on COREPRU 7: Overall risk assessment (FG26/9), which sets out the FCA's expectations for firms on completing the overall risk assessment required under the new Core Prudential sourcebook (COREPRU). The guidance explains how firms can link their business model, risk appetite, financial resource planning, and wind-down planning into one coherent process. It considers how firms should complete the overall risk assessment, the documentation, and how the risk assessment interacts with the FCA's Supervisory Review and Evaluation Process.
• Non-Handbook Guidance on CRYPTOPRU 7: Overall risk assessment for CRYPTOPRU firms (FG26/10), which sets out the FCA's expectations for firms on completing the overall risk assessment required under the new Prudential sourcebook for CRYPTOPRU firms (CRYPTOPRU). It is intended to help firms develop their own assessments, calculate financial resource requirements, and understand the implications of their wind-down plans.

Both sets of guidance will come into force on 25 October 2027, when the new UK crypto regime comes into force.

The UK Financial Conduct Authority (FCA) has published policy statement PS26/19, setting out its final rules to align listed issuers' sustainability and climate disclosures with UK Sustainability Reporting Standards (UK SRS), the UK-endorsed version of the International Sustainability Standards Board (ISSB) Standards. The final rules adopt a comply or explain approach across the UK SRS. The rules will replace the existing Task Force on Climate-related Financial Disclosures (TCFD)-aligned disclosures. Following feedback from the January consultation, the FCA has simplified the regime in two ways by requiring:

• a comply or explain approach across all categories of disclosures, bringing UK SRS S2 (climate disclosures) into line with the approach it consulted on for UK SRS S1 (non-climate disclosures) and Scope 3 (emissions data)
• international commercial companies with a secondary listing and depositary receipt issuers to also report against UK SRS on a comply or explain basis, in place of the consultation proposal to signpost any reporting requirements and disclosures under their home jurisdiction.

To support companies to apply the comply or explain rules, the FCA is also consulting on technical note (TN) 803.1 and related updates to existing technical guidance under TN 801.4, and the proposed deletion of TN 802.3. The proposals are outlined in the FCA's Primary Market Bulletin (PMB) 66. We cover PMB 66 separately in the Securities section above. The deadline for comments is 28 October and the FCA aims to finalise the guidance before the rules come into force.

The new rules will apply to accounting periods beginning on or after 1 January 2027, with first reporting due in 2028. Transitional reliefs will apply for one year for Scope 3 emissions disclosures and for two years for UK SRS S1 disclosures. The FCA also published some practical considerations in PMB 66 to support companies. The FCA also intends to organise a series of activities to help companies and investors understand the UK SRS and what is required under the rules.

The Bank of England (BoE) has published an insights article by Andrew Bailey, Governor of the BoE, on frontier AI and the question of governance. Mr Bailey argues that while the risks are real and increasingly significant, policymakers should not automatically turn to the questions of regulation. Instead, they should first ask what precisely the problem is that they are trying to solve. In his view, the challenge posed by frontier AI is that, in its most advanced forms, it threatens to operate outside society's framework of shared norms. A sufficiently powerful system functioning within a self-reinforcing loop risks reducing society's ability to exercise meaningful oversight and intervention. He is clear that this does not mean prohibiting frontier AI, whose potential benefits include driving scientific discovery, enhancing productivity and contributing to economic prosperity. However, society must retain the ability to intervene, to establish the boundaries within which these systems operate, and to revise those boundaries as the technology evolves.

Mr Bailey identifies rigorous model testing, conducted before and after deployment, as a sensible starting point. He notes that the UK's AI Security Institute is helping to develop the scientific and technical foundations of AI assurance, although the pace of progress must accelerate. In his view, testing should not be seen as an alternative to future regulation, nor as a complete solution. A more formal regulatory framework may well emerge over time, but understanding, testing, and establishing credible points of intervention must come first. Mr Bailey also links these issues to financial stability. He warns that frontier AI materially increases the scale and sophistication of cyber-threats facing the financial system, and that the resilience of payments networks, financial market infrastructures and banks can no longer be considered separately from AI advances. Rigorously testing the models that firms use will help to show how AI can be deployed safely. In time, that understanding could be codified into standards to ensure a consistent approach across the financial system.

The UK Office of Financial Sanctions Implementation (OFSI) has published its annual frozen assets reporting notice alongside a reporting template, launching its 2026 review of frozen assets held under UK financial sanctions regimes. Persons holding or controlling funds or economic resources owned, held, or controlled by designated persons are required to submit a report to OFSI by 30 November, covering the value of relevant frozen assets as at the close of business on 30 September. The reporting obligation extends to assets held in the UK as well as those overseas where they are subject to UK financial sanctions legislation. The notice also reminds firms of their ongoing obligations to identify and freeze assets belonging to designated persons (and entities they own or control), report newly frozen assets to OFSI without delay, and provide information requested by OFSI.

The Annex to the notice provides a general description of the information to be reported. All returns must be submitted using the prescribed template. OFSI states that there is no requirement to submit a nil return where a person does not hold or control any funds or economic resources owned, held, or controlled by a designated person. However, if a person submitted a report last year (other than a nil return) and no longer holds those assets, they should submit a nil return.

The EU Anti-Money Laundering Authority (AMLA) has published three sets of final draft regulatory technical standards (RTS) defining key measures companies and professionals must apply to reduce anti-money laundering and countering terrorist financing (AML/CTF) under the EU AML Regulation ((EU) 2024/1624) (AMLR). For more background on the package, you may like to read our article "AML playbook: the new EU AML/CTF package". The three final draft RTS each cover a distinct area of AML/CTF requirements for the private sector:

• Draft RTS on group-wide minimum requirements and additional measures for subsidiaries and branches in third countries under Articles 16(4) and 17(3) of the AMLR. They are accompanied by two fact sheets covering group-wide requirements and legal impediments in third countries. The RTS set out minimum requirements for effective group-wide AML/CTF arrangements, including governance, risk management, internal controls, and secure information sharing. The RTS were previously consulted on in April.
• Draft RTS on customer due diligence (CDD) under Article 28(1) of the AMLR. They specify in detail how CDD requirements should be applied, including the information and documents to be collected. The RTS are accompanied by a fact sheet. They were previously consulted on in February.
• Draft RTS on criteria for identifying business relationships, occasional transactions and linked transactions as well as lower thresholds under Article 19(9) of the AMLR. They form the structural basis upon which CDD obligations apply. The RTS set out how companies and professionals should distinguish between the business relationships and occasional transactions, as well as how to identify linked transactions so that CDD thresholds are applied consistently. The RTS are accompanied by a fact sheet. They were previously consulted on in February and AMLA has made some revisions to improve clarity.

The final draft RTS will be submitted to the European Commission for adoption. Once adopted, they will be published in the Official Journal of the European Union and come into force 20 days later. They are expected to apply six months after they enter into force, except for specified provisions which will apply from 10 July 2029.

The UK Prudential Regulation Authority (PRA) has issued a Dear CFO Letter setting out thematic feedback from its annual review of written auditor reports of selected PRA-regulated deposit-takers, covering IFRS 9 expected credit loss (ECL) and accounting for climate risk. The PRA confirms that it has seen continuous improvements in firms' capabilities, controls, and governance in these areas.

The feedback covers:

• Data governance, where the PRA encourages continued enhancements in identifying material ECL data, and strengthening end-to-end accountability, data quality controls, and data lineage.
• Model risk, where the focus is on firms' responsiveness to emerging risks, the completeness of post- model adjustments, and ensuring model monitoring continues to support timely identification of model performance issues and mitigating actions.
• Climate risk, where the PRA encourages continued development of more granular risk assessments, stronger links between scenario analysis and ECL judgements, and the models and data to assess and reflect evolving climate-related credit risks.

Firms are encouraged to review the Annex to the letter, which sets out a range of practices observed by the PRA, together with its areas of focus. The PRA has requested auditors' views on firms' progress in these areas for the 2027 review. Auditors are also asked to report on firms' processes for identifying and monitoring credit risk in private market exposures and for reflecting changes in ECL in a timely manner.

The European Securities and Markets Authority (ESMA) has published its 2027 work programme, setting out its priorities for strengthening, simplifying and integrating EU capital markets. It marks a decisive shift from analysis and groundwork to implementation and concrete delivery, building on the foundations laid in 2025 and 2026 and bringing key strategic cycles to completion. Key areas of work for 2027 include:

• Growing supervisory mandates: ESMA will advance its supervision of consolidated tape providers and external reviewers of European Green Bonds, and will process the applications and begin the supervision of environmental, social and governance (ESG) rating providers. ESMA will also adapt to its expanded responsibilities for benchmark administrators. It will carry out oversight of critical ICT third-party service providers and continue monitoring and promoting compliance with the Digital Operational Resilience Act (DORA) across all of its supervisory mandates. ESMA will also review the impact of EMIR 3 reforms and continue cooperation with national competent authorities, including on the supervision of cryptoasset service providers under the Markets in Crypto-Assets Regulation (MiCAR).
• Delivering more efficient financial markets: ESMA will prepare for changes to its mandates and responsibilities arising from the proposed Market Integration and Supervision Package (MISP), and support implementation of the European Single Access Point and the transition to T+1 settlement. It will also continue work on investor protection by supporting the implementation of the Retail Investment Strategy and promoting clear, accessible information for investors. ESMA has also stated that its simplification initiatives on transaction reporting, funds reporting, the retail investor journey and risk-based supervision will enter a new phase in 2027.
• Harnessing data and technological innovation: ESMA will further enhance its use of data and technology, including AI-based supervisory tools. It will also strengthen cybersecurity capabilities and continue its work on cryptoassets and the impact of AI on financial markets. Tokenisation will also remain a priority.

The Financial Markets Standards Board (FMSB) has published an updated version of its standard for sharing of standard settlement instructions (SSIs), together with updated SSI templates. The standard aims to increase the adoption of electronic solutions that allow for standardisation and pre-authentication of settlement instructions, and facilitate straight-through processing, to improve the efficiency of SSI management by recipient counterparties and reduce settlement fails through incorrect SSIs. It sets out nine core principles relevant to the sharing of SSIs, covering: use of industry platforms; off-platform; timing; data fields; data format; data validation; validity; governance and responsibility; and periodic review. Where such electronic solutions are not legally or operationally feasible, the standard provides templates for the manual sharing of SSIs.

Updated FAQs published alongside the updated standard and templates acknowledge that it may not always be possible to comply with the standard in all circumstances and at all times in core principle 9 (periodic review). There is an explicit carve-out for automation for sharing of SSIs where it is not "legally or operationally feasible", and for clarity purposes, the FMSB has now introduced a similar carve-out in core principle 2 (off-platform) for non-use of the template. The FAQs provide the following examples of situations under core principle 2 to which this carve-out may apply:

• Markets which require a local broker and/or custodian to access, where use of the template is not accepted by those actors.
• Markets in which regulations around data transmission and/or storage may prohibit the use of the template.
• Markets in which a regulator, market infrastructure, custodian or local agent mandates a specific form, format, or submission channel that is fundamentally incompatible with the FMSB template.

The FAQs also state that any exemption should be based on a genuine and documented legal or operational constraint, rather than local preference and should be reviewed at least annually as per core principle 9. Additionally, the FAQs confirm that the standard and templates have been recognised by both the EU Industry Committee for T+1 and the UK Accelerated Settlement Taskforce as supporting more efficient settlement processes, particularly in light of the planned move to T+1 settlement in the UK and EU in 2027.

The UK Financial Conduct Authority (FCA) has published Handbook Notice No. 144, outlining amendments to its Handbook made by various instruments including:

• Markets in Financial Instruments (Record Keeping, Transaction Reporting and Financial Instrument Reference Data) Instrument 2026, which comes into force on 3 April 2028. The instrument makes changes to the scope, content and operation of the transaction reporting regime. The changes aim to simplify firms' reporting obligations, reduce duplicative or low-value reporting and improve consistency in how key fields are populated.
• Changes to Information Flows for UK Equity IPOs Instrument 2026, which came into force on 5 August. This instrument updates the FCA's rules on information sharing during UK equity initial public offerings (IPOs) to reduce market risk and frictions in the UK IPO process for issuers and market participants.
• Collective Investment Schemes Sourcebook (Liquidity Management) Instrument 2026, which comes into force on 1 February 2027. Introduced following the consultation published in CP25/38, the instrument makes targeted improvements to the liquidity risk management framework for authorised fund managers (AFMs) of UK Undertakings for Collective Investment in Transferable Securities (UCITS) schemes and non-UCITS retail schemes. The changes promote the effective use of antidilution tools, clarify good practice for AFMs' assessment of the liquidity of securities held in funds, and introduce new guidance on stress testing.
• Perimeter Guidance (Regulated Cryptoasset Activities) Instrument 2026. Part 1 of Annex B of this instrument came into force on 16 September, with the remainder coming into force on 25 October 2027. It sets out perimeter guidance for the UK's future cryptoasset regime, helping firms understand when authorisations for cryptoasset activities will be required.
• Collective Investment Schemes Sourcebook (Cryptoasset Exchange Traded Note) Instrument 2026, which came into force on 28 September. Introduced following the consultation published in chapter 5 of CP26/17, the instrument allows certain authorised funds to hold cryptoasset exchange traded notes, subject to a limit of 10% of scheme property for retail funds.
• Cryptoasset Activities (Periodic and Application Fees) Instrument 2026, which came into force on 30 September, with Part 2 of the annex coming into force on 25 October 2027. This instrument sets out the application fees and periodic fees that firms with cryptoasset regulated activities permissions will pay to fund the FCA and the UK Financial Ombudsman Service.
• Disclosure of Climate-Related Financial Information (Asset Manager and Asset Owner) (Amendment) Instrument 2026, which came into force on 25 September. This instrument simplifies the FCA's Task Force on Climate-related Financial Disclosures product-level reporting requirements for asset managers, life insurers and FCA-regulated pension providers in the ESG sourcebook. It introduces more targeted climate disclosure rules that reduce complexity and burden for firms, while improving the clarity and usability of climate information for investors.
• Financial Promotion (Notification of Cryptoasset Approval) Instrument 2026, which came into force on 1 October. Introduced following the consultation published in chapter 6 of CP26/17, the instrument removes the requirement to submit notifications for most approvals of cryptoasset promotions, reducing the burden on both firms and the FCA.
• Decision Procedure and Penalties Manual (Cryptoassets) (Amendment) Instrument 2026. Part 1 of Annex B came into force on 30 September, with the remainder coming into force on 25 October 2027. Introduced following the consultation published in CP26/19, the instrument makes minor and consequential amendments to the Decision Procedure and Penalties Manual and the Glossary arising from the introduction of the market abuse regime for cryptoassets. The amendments apply the FCA's existing market abuse penalty framework to cryptoasset market abuse and identify the FCA decision-makers responsible for exercising powers under the transitional provisions of the Cryptoassets Regulations.
• Data Decommissioning (No 2) Instrument 2026, which came into force on 1 October. This instrument simplifies the scheduling rule for Section M of the Retail Mediation Activity Return and clarifies guidance notes for firms completing the FIN073 return.
• Pensions Projections Exemption Instrument 2026 and Conduct of Business (Interactive Pension Simulations) Instrument 2026, both of which came into force on 25 September.

Feedback for the various consultations behind the Handbook Notice is set out in chapter 3 of the notice.

The European Banking Authority (EBA) has launched a consultation on proposed revisions to its implementing technical standards (ITS) governing the joint decision process for institution-specific capital and liquidity requirements under Article 113 of the Capital Requirements Directive 2013/36/EU (CRD), as amended by Directive 2024/1619 (CRD VI). Article 113 of the CRD establishes the framework for joint decisions within supervisory colleges on institution specific prudential requirements for cross border banking groups. Since the ITS were first adopted in 2014, the prudential and supervisory framework has evolved significantly, including through changes introduced by CRD V (Directive (EU) 2019/878), which extended joint decisions to cover Pillar 2 guidance and leverage ratio-related elements. Changes were also introduced by the revised EBA Guidelines on the Supervisory Review and Evaluation Process (SREP). The EBA is proposing a comprehensive revision to streamline the joint decision process, simplify templates and better align the framework with current supervisory practice.

Key proposals include:

• supporting a more holistic and coordinated assessment of institutions' prudential requirements and guidance
• streamlining and simplifying templates, by introducing a single, reduced and integrated risk assessment report
• aligning the joint decision process with the revised SREP framework and current supervisory practices
• more clearly incorporating qualitative supervisory measures into the joint decision process
• updating the scope of joint decisions to include Pillar 2 guidance and leverage ratio-related Pillar 2 requirements and guidance.

The deadline for comments is 4 January 2027.

The European Commission (EC) has published a letter (dated 21 September) to the European Supervisory Authorities (ESAs), inviting them to deliver technical advice on private credit activities and exposures of EU banks and non-bank financial institutions (NBFIs). The letter enclosed a call for technical advice, which sets out the context for the invitation and notes the recent rapid growth of the private credit sector, the advantages offered by its customisability, the link between private equity and private credit activities, and the link between banks and NBFIs which needs to be better understood.

The EC have scoped the advice to cover the following four areas:

• Lending and investment exposure of EU banks and NBFIs to private credit activities.
• Gaps in the existing reporting framework.
• Retail investor participation.
• Mapping the interconnection between banks and NBFIs.

The advice should consider direct lending and investment in private credit funds or private credit instruments, and the EC has requested that the ESAs focus on unsecured direct lending to private companies and individuals in particular. EU banks and EU NBFIs are in scope, as well as non-EU subsidiaries. The data which should be used for producing this advice should be limited to data from regulatory reporting and/or commercial data sets.

The EC invites the ESAs to set up a task force to discuss and agree the technical specification in the call for advice which relates to common definitions, data management and processing (among other things) with the participation of the other European regulatory authorities. In terms of the expected timetable, the EC invites the report to be delivered within six months from the date of receipt of the call for advice, if possible.

The European Banking Authority (EBA) has published its response to the European Commission's targeted consultation on the review of the Regulation on Markets in Crypto-assets (Regulation (EU) 2023/1114) (MiCAR). The targeted consultation contained technical and legal questions on whether MiCAR remains fit for purpose in light of evolving market and international developments.

The response includes detailed answers and recommendations across the consultation's coverage of scope, asset-referenced tokens and e-money tokens, crypto-asset service providers, and areas beyond the current scope of MiCAR. Of particular interest are the following:

• Harmonisation definitions: the EBA recommends that further harmonisation on the definitions of financial instrument and tokenised deposits is needed to prevent divergent national approaches. In the EBA's view, tokenised financial instruments should remain out of scope of MiCAR.
• Classification: the EBA recommends that further analysis be carried out as to classification of commodities-linked tokens as there is still a lack of clarity on regulatory status of such tokens and notes the risk of arbitrage in the absence of regulatory clarity in edge cases such as hybrid tokens, synthetic exposure, and "wrapped" tokens.
• Prudential requirements: the EBA response requests clarification as to the application of requirements to entities which are both issuers and crypto-asset service providers and improvements to own funds requirements, among other recommendations in relation to alignment and calibration. The EBA also suggests reducing the deposit requirement for e-money token reserve assets.
• Crisis management: the EBA suggests extending the toolkit to non-bank issuers and further mechanisms to better coordinate recovery and redemption planning.
• Lending - the EBA recommends regulating crypto-asset lending, including activities linked to decentralised finance, in view of the risks posed to consumers.
• Third-country multi-issuer stablecoin schemes: the EBA recommends a dedicated regulatory and supervisory regime to mitigate the significant risks posed by these schemes.

The EBA also provides feedback in relation to group supervision, reporting, and the interplay between MiCAR and other payment services regulation.

The UK Financial Conduct Authority (FCA) has published findings from a multi-firm review on money mule activity (a form of money laundering in which a person transfers or receives criminal funds on behalf of others) and the cashing out of fraud proceeds. The review drew on a survey of 35 firms and analysis by an industry working group of 22 firms.

Key findings include:

• Retail banks accounted for most transactions passing through mule accounts, whereas other firms experienced lower volumes but higher-value transactions.
• Card payments were the most common cash-out method, as they can resemble legitimate consumer spending and are a versatile route for dispersing and monetising fraud proceeds.
• International and crypto cash-out methods were typically higher in value, showing that mule activity was not confined to UK payment flows.
• Repeat mule accounts suggest organised criminal infrastructure rather than an isolated or opportunistic misuse, as some accounts had been used multiple times for mule activity before firms shut them down, and there were accounts across multiple scam and fraud types.

The FCA expects firms to review their controls for detecting, preventing and disrupting money mule activity and to strengthen them where necessary. Firms should consider indicators beyond the initial receiving account, including linked accounts, payment characteristics and the broader transaction context. The FCA also highlights the importance of information-sharing, including through the provisions available under the Economic Crime and Corporate Transparency Act 2023, and is working with the National Economic Crime Centre to issue a further alert providing additional details of the working group's findings.

The Bank of England (BoE) has published a consultation paper on its proposed supervisory fees regime for recognised payment systems and specified service providers for the 2026/27 fee year. The BoE proposes increasing fees to reflect rising supervision costs, including greater focus on operational resilience and payments policy development. It is consulting on fee levels both under the current statutory fee cap (GBP760,000 per firm) and a proposed higher cap (GBP1.7 million) currently being consulted on by HM Treasury (HMT) earlier this year. The consultation also reflects the introduction of a new third impact category for less systemic payment systems, intended to support innovation through lower, proportionate fees.

Subject to the outcome of HMT's consultation and parliamentary approval of any proposed regulations, the revised fee regime would also apply to digital settlement asset service providers once they fall within scope of the BoE's supervisory remit. The deadline for responses to the BoE consultation is 22 October. The final fee will be confirmed in the fee policy statement issued once HMT has completed its process, including details of any transitional pro-rating if the fee cap is increased during the fee year. The proposals are currently expected to be implemented in Q4 of the 2026/27 fee year.

A Corrigendum to Directive (EU) 2023/2225 on credit agreements for consumers and repealing Directive 2008/48/EC (CCD2) has been published in the Official Journal of the European Union, correcting a number of drafting and cross-reference errors in the Directive.

The amendments include:

• a correction to the list of provisions referenced in Article 2(7), replacing a reference to Article 21(1), first subparagraph, point (r) (which refers to rights in relation to linked credit agreements) with point (s) (which refers to the early repayment provisions in Article 29)
• an amendment to Article 3(20)(a), which defines linked credit agreement, clarifying that the credit itself, rather than the credit or services, must exclusively finance the relevant supply agreement
• a correction to Article 10(5)(d) in relation to pre-contractual information for credit agreements providing different ways of drawdown with different charges or borrowing rates, that the relevant assumption is that set forth in Annex III, Part II, point (c) (not point (b))
• a clarification in Article 16(2)(a) in relation to consumer information around the provision of advisory services concerning recommendations made by the firm, and specifically whether they are based on a firm's own product range or a broader market assessment.

The Corrigendum makes technical corrections only and does not introduce substantive policy changes to the consumer credit framework.

The EU Platform on Sustainable Finance, an advisory body to the European Commission (EC), has published a brief setting out its views on the European Securities and Markets Authority's (ESMA) consultation on proposed reforms to certain key performance indicators (KPIs) and other provisions of the Disclosures Delegated Act under the Taxonomy Regulation (EU) 2020/852. The consultation forms part of the EC's broader Omnibus simplification agenda and follows its March call for technical advice from the European Supervisory Authorities (ESAs) on the review of the Taxonomy reporting framework.

ESMA's consultation covered potential simplifications relating to: (i) the operational expenditure (OpEx) KPI; (ii) voluntary use of the OpEx KPI by financial undertakings; (iii) group Taxonomy reporting; and (iv) additional possible simplifications.

The Platform makes four main recommendations:

• OpEx KPI: to adopt a two-tier approach consisting of: (i) a mandatory OpEx KPI limited to research and development (R&D) expenditure; and (ii) a voluntary opt in broader OpEx KPI based on the current denominator for companies wishing to disclose additional transition related operational expenditure.
• Group reporting: to remove the weighted average consolidated KPI. If a single KPI is required, the KPI arising from the group's main reporting regime should be used, with the regime to be determined based on the group's prevalent activity.
• Climate change adaptation: to incorporate certain clarifications directly into the Disclosures Delegated Act, as suggested by ESMA.
• Capital expenditure type C (CapEx C): to retain this as a mandatory metric. The Platform is working on a proposal to improve its definition by clarifying its scope and application.

The European Central Bank (ECB) has published an updated guide to licensing applications, replacing the previous 2019 version. The guide applies to authorisation applications under the Capital Requirements Regulation, including, but not limited to, initial authorisations for credit institutions, bridge bank applications and licence extensions. It aims to enhance transparency and consistency in the assessment of applications across participating member states and reflects developments in supervisory practice, EU legislation and European Banking Authority guidance. Among other things, it provides detailed guidance on the licensing process, including pre-application engagement, assessment criteria and timelines. The guide will be reviewed periodically to reflect further supervisory, European and international developments. The ECB emphasises that the guide is not legally binding and does not replace any requirements under EU or national law.

The European Commission (EC) has published a draft Delegated Regulation for a four-week feedback period, proposing amendments to the regulatory technical standards (RTS) laid down in Commission Delegated Regulation (EU) 2016/1052 regarding the conditions applicable to buy-back programmes and stabilisation measures. The amendments to the buy-back regime reflect changes introduced by the Listing Act (Regulation (EU) 2024/2809), which amended Article 5 of the Market Abuse Regulation (MAR) to simplify reporting and disclosure obligations for buy-back transactions. The amendments to the stabilisation regime were added in response to requests from certain national competent authorities.

The key changes are as follows:

• Issuers will be required to report buy-back transactions in respect of shares in aggregated form only, to the competent authority of the most relevant market in terms of liquidity, rather than to the competent authority of each trading venue on which the shares are admitted to trading or traded.
• Public disclosure of buy-back transactions in respect of shares will similarly be required in aggregated form, indicating the aggregated volume and the weighted average price per day and per trading venue, by no later than the end of the seventh daily market session following the date of execution.
• Separately, public disclosure and reporting of stabilisation transactions will also be required in aggregated form, indicating the aggregated volume and the weighted average price per day and per trading venue, replacing the current requirement to disclose the details of each stabilisation transaction. Public disclosure is required by the same deadline – the end of the seventh daily market session following the date of execution. Reporting will be required only to the competent authority of the most relevant market in terms of liquidity for each of the securities and instruments concerned, which must, upon request, forward the information to the competent authority of each trading venue on which the securities and associated instruments are admitted to trading and traded.

The deadline for feedback is 19 October. The amending Delegated Regulation will enter into force on the 20th day following its publication in the Official Journal of the European Union.

The House of Commons Treasury Committee has published a report containing the government's and the UK Financial Conduct Authority's (FCA's) responses to the Committee's inquiry report on HM Treasury's (HMT) financial inclusion strategy. In its response, the government agreed with the Committee on the importance of a robust evidence base for financial inclusion policy, including evidence that enables government to assess whether interventions are improving outcomes for people experiencing financial exclusion and are reaching those most in need. However, the government rejected calls to publish a separate quantitative analysis of financial exclusion specifically, stating that this would duplicate ongoing work already undertaken in developing the strategy and would largely reproduce publicly available evidence that has already been assembled and assessed. The response also noted that, as set out in the strategy, HM Treasury will conduct a review within two years to assess the impact of the strategy's interventions. In addition, both the government and the FCA confirmed their view that a broad firm-level financial inclusion metrics regime was not necessary, and the FCA response stated that such a regime would not be the most effective or proportionate means of improving financial inclusion outcomes.

The responses also highlighted a number of new data collection initiatives, including detailed Product Sales Data for consumer credit agreements, which it states will be used alongside advanced analytics to better understand barriers to access. The FCA in addition referred to its new annual Retail Banking Business Models Data return covering mortgages, personal banking, personal lending and small business banking which will help with providing both market-wide and firm-level information about the provision of banking services to consumers and small and medium-sized enterprises.

The European Banking Authority (EBA) has published its final guidelines on the sound management of third-party risk relating to non-ICT services (EBA/GL/2026/09), replacing the EBA's 2019 Guidelines on outsourcing arrangements. The guidelines establish a comprehensive framework for the governance, risk assessment, and oversight of third-party service providers (TPSPs) supplying non-ICT services to in-scope financial services entities, with a particular focus on services supporting "critical or important functions" (which are as defined in the EU Digital Operational Resilience Act (DORA)). The guidelines aim to harmonise the management of third-party risk and the use of TPSPs in relation to non-ICT services to a level more consistent with ICT services under DORA.

Read more.

The Single Resolution Board (SRB) has published its operational guidance for banks' communication in resolution scenarios, along with a communication testing supplement to its existing operational guidance on resolvability testing for banks. The guidance is aligned with the European Banking Authority resolvability framework and supports the implementation of the existing SRB's Expectations for Banks. The SRB states that it does not introduce new requirements but instead clarifies how banks should prepare and test their ability to communicate effectively with internal and external stakeholders during a resolution event or crisis.

Key areas covered include: (i) coordination between banks and the resolution authorities; (ii) consideration of moratorium tools under the Bank Recovery and Resolution Directive in communication planning; (iii) banks' communication plans for resolution; and (iv) governance arrangements for communication during resolution. The guidance was consulted on in October 2025. The SRB confirms that banks will have until April 2028 to consider and incorporate the operational guidance, where necessary, into their communication plans.

The UK Financial Conduct Authority (FCA) has published a feedback statement (FS26/2) from its review into whether regulation affects small and medium-sized enterprises' (SMEs) ability to access finance. The review found no evidence that FCA regulation is a major barrier to SME lending, but instead, found that many of the challenges relate to the wider market, information and capability. This is particularly the case for microbusinesses, who face issues such as limited awareness of finance options, complex application processes, duplicated customer checks and difficulties obtaining finance where businesses have limited collateral or predominantly intangible assets.

To reduce friction and support growth, the FCA has identified three priority areas for further work: (i) supporting a more proportionate regulatory framework through reform of the Consumer Credit Act; (ii) advancing open finance with SME lending as a priority use case; and (iii) monitoring industry work to explore whether digital verification could reduce duplication in customer checks, while maintaining effective financial crime controls.

The House of Lords Financial Services Regulation Committee has launched a call for evidence as part of its inquiry into regulatory sandboxes in UK financial services. The inquiry will examine the purpose, effectiveness and wider impact of regulatory sandboxes, including the UK Financial Conduct Authority (FCA)'s Regulatory Sandbox and Digital Sandboxes, as well as the Digital Securities Sandbox operated jointly with the Bank of England. The Committee is seeking views on whether sandboxes promote innovation, offer wider public benefits and value for money, shape markets through their selection of firms, and help to produce good regulatory policy, particularly for emerging technologies. The inquiry will also consider firms' experiences of participation, the use of sandboxes to test agentic AI, and how the UK's approach compares with those adopted in other jurisdictions and sectors. The deadline to submit evidence is 5pm on 23 October.

The European Commission has adopted a Delegated Regulation supplementing the Capital Requirements Directive 2013/36/EU, as amended by Directive 2024/1619 (CRD VI), with regard to regulatory technical standards (RTS) specifying the booking arrangements that third-country branches (TCBs) must apply for the purposes of Article 48h CRD. The RTS set out the methodology that TCBs must follow to track and maintain a precise and comprehensive record of all assets and liabilities booked or originated by the TCB, and off-balance sheet items, in each case that arise from transactions on the basis of their authorised activities, transactions that do not require authorisation, intragroup transactions, and transactions entered into on the basis of reverse solicitation of services.

The RTS also specify the minimum information that must be maintained in the registry book, together with information on their associated risks, taking into account the size and complexity of their operations. The Regulation is based on the European Banking Authority's final draft RTS published in January. It will enter into force on the 20th day following publication in the Official Journal of the European Union and will apply from 11 January 2027.

The UK Financial Conduct Authority (FCA) has published findings from its review of how payments and e-money firms are supporting consumers in vulnerable circumstances under the consumer duty. The review assessed firms' approaches to identifying vulnerability, providing tailored support and monitoring customer outcomes. The FCA found many examples of positive practice but also identified specific areas for improvement, including:

• Some firms identified very few or no customers in vulnerable circumstances, despite having customer bases where characteristics of vulnerability may reasonably be expected.
• There was limited testing or assurance to assess how effectively identification policies were being implemented in practice.
• Approaches on support arrangements were not always applied consistently across the customer journey, and some firms could not clearly evidence how vulnerability information translated into tailored support for customers.
• Communications relied primarily on standard formats, with limited tailoring for customers with different needs, and limited assessment on whether communications were understood and effective in practice.
• The frequency and quality of management information provided to senior management and boards could be improved. Boards at certain firms received limited insight beyond annual consumer duty reporting, and vulnerability data and outcomes information were not consistently recorded, reducing firms' ability to identify trends and take corrective action.
• Understanding the impact of distribution arrangements on consumer outcomes.

Firms are advised to consider these findings when assessing their own arrangements. The FCA will continue to engage with firms in this area and intervene where necessary.

The UK Financial Conduct Authority (FCA) has published policy statement PS26/18, setting out its final perimeter guidance on the new regulated cryptoasset activities introduced under the upcoming UK cryptoassets regime (PERG 18). The guidance seeks to clarify the scope of those activities, the regulatory perimeter, and when authorisation and permissions may be needed.

Following the April consultation, the FCA has proceeded largely as consulted on, with a number of targeted clarifications following feedback, including on the application of the "by way of business" test, the territorial scope of the regime, the distinction between qualifying cryptoassets and specified investment cryptoassets, the treatment of cryptoassets that are solely records of rights or value and of hybrid token structures, and the distinction between activities that do amount to arranging and activities that are unlikely to do so.

The government has also laid a further statutory instrument (SI) before Parliament amending the Cryptoasset Regulations 2026. The FCA states that the guidance in PS26/18 does not yet reflect the new SI. The FCA plans to consult in early Q4 on further PERG amendments addressing the new SI, with final amended guidance expected in early 2027.

The Financial Services and Markets Act 2000 (Cryptoassets) (Miscellaneous Amendments) Regulations 2026 have been laid before Parliament, accompanied by a draft explanatory memorandum. The Regulations were previously consulted on in April and make targeted amendments to the UK cryptoassets regulatory framework established by the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026.

Amongst other amendments and additions, the Regulations:

• Exclude activities involving UK qualifying stablecoins by an authorised person under FSMA for the activity of issuing such stablecoins from the regulated activities of dealing in qualifying cryptoassets as principal, dealing as agent, and arranging deals in qualifying cryptoassets.
• Exclude the temporary holding of UK qualifying stablecoins from the cryptoasset safeguarding activity, where they are being held in connection with a payment transaction.
• Clarify the regulatory perimeter for issuing UK qualifying stablecoins and exclude backing asset arrangements for those stablecoins from the relevant safeguarding regulated activities.
• Introduce targeted exemptions for certain cryptoasset proprietary trading, market making, technical services, and central securities depository activities.
• Make related changes to the financial promotion regime, including clarifying the regulatory perimeter for stablecoin issuance and backing asset arrangements and mirroring the exemptions in the FSMA (Regulated Activities) Order 2001 for certain proprietary trading, market making and central securities depository activities.
• Create a new controlled activity for the purposes of the financial promotion restriction (issuing qualifying stablecoin) and consequently a new controlled investment (qualifying stablecoin).
• Bring forward the commencement of provisions that provide that assets backing qualifying stablecoins are not treated as collective investment schemes, alternative investment funds or electronic money.

The changes are intended to remove overlapping or disproportionate regulatory requirements and unnecessary regulatory barriers, while maintaining high standards of regulation for activities that present material risks to consumers or market integrity. Firms excluded from regulation by this instrument continue to have obligations under other legislation, including anti-money laundering requirements.

The European Parliament's Economic and Monetary Affairs Committee (ECON) has published the text of the report it has adopted on the European Commission's proposal for a Regulation amending the Sustainable Finance Disclosure Regulation (SFDR), following the adoption of its negotiating mandate on 10 September. The report includes a draft European Parliament legislative resolution setting out the Parliament's proposed amendments to the Regulation (known as the SFDR 2.0 proposal). The Council of the EU previously adopted its negotiating position in June.

The UK government has published its anti-money laundering and asset recovery strategy 2026–2029, setting the direction for the UK's response to money laundering and criminal asset recovery over the next three years. Alongside the UK Anti-Corruption Strategy and UK Fraud Strategies, this strategy forms part of the Government's overall approach to economic crime as will be set out in the forthcoming Economic Crime Plan 2026-29.

Measures proposed include:

• Structural reform of the UK's anti-money laundering and counter-terrorist financing supervisory regime (AML/CFT), reducing the number of supervisors from 25 to three.
• Review of how the future of financial payments will impact threats and addressing risks and opportunities presented by the growing use of stablecoins.
• Developing a policy roadmap for addressing risks and opportunities of privacy enhancing technologies in relation to cryptoassets.
• Review of the suspicious activity reporting (SARs) regime for opportunities to reduce low-value activity, including whether to raise the suspicion threshold in POCA and finalising implementation of the SARs Digital Service with AI-enhanced analytics.
• Develop an agreed problem statement regarding law enforcement speed of access to basic bank account information and a review of options.
• Use of the UK's FATF Presidency (2026–28) and G20 Presidency (2027) to promote reform of international AML standards to support a more risk-based approach and reduce low-value compliance activity.

Annex A to the strategy sets out a delivery plan, detailing key actions and milestones across 2026–29.

The Financial Services and Markets Bill has completed its third reading in the House of Lords and was subsequently introduced in the House of Commons for first reading. Parliament also published the Bill as brought from the Lords, reflecting amendments agreed during its passage through the House of Lords. A date for the second reading in the House of Commons has not yet been announced.

The UK Financial Conduct Authority (FCA) and the Bank of England (BoE) have published a feedback statement on tokenisation in UK wholesale financial markets, summarising responses to their May joint call for input. Respondents were largely supportive of the authorities' vision and recognised that industry and regulators would need to work together to tokenise wholesale markets. The most frequently raised themes included:

• A desire for faster progress, with clear timelines and implementation milestones in the forthcoming tokenisation roadmap.
• A move beyond sandboxes and pilots towards full production, scale and permanence.
• Clarity on the prudential treatment of tokenised assets and the eligibility of tokenised assets as collateral (in both central bank operations and for central clearing at central counterparties), with tokenised Money Market Funds frequently mentioned by buy-side firms.
• Access to insolvency protections under the settlement finality regulations for blockchain-settled transactions, and the use of stablecoins as settlement assets.
• Prioritisation of regulatory work on interoperability, encompassing legal, regulatory and cross-jurisdictional dimensions.
• A preference for aligning custody rules for relevant specified investment cryptoassets (RSICs) broadly with CASS 6, with targeted overlays for blockchain-specific risks such as private key management.

The FCA and BoE have confirmed they will publish a tokenisation roadmap later in the year setting out detailed workstreams and target dates. Key commitments include progressing work on tokenised collateral, with a supervisory statement and discussion paper on central counterparties collateral due later this year, and consulting on rules for the safeguarding of RSICs in the first half of 2027.

Alongside the feedback statement, the FCA has issued a call for input on tokenised gold.

The UK Financial Conduct Authority (FCA) has published a call for input on whether tokenisation could improve the trading, transfer, mobilisation and use of gold as collateral while maintaining market integrity and consumer protection. The call follows feedback received in response to the FCA's and Bank of England's joint call for input on tokenisation, recognising gold as a significant potential use case given the international strength of the London spot gold market, and the increase in tokenised gold and other gold-related products in recent years.

In terms of scope, the FCA acknowledges a number of key questions around the regulatory perimeter and the status of gold as a commodity, and states that its objective is not to regulate segments of the gold trading market that fall outside the FCA's current remit. The call focuses on gold products that confer ownership rights in underlying physical gold which are clearly defined and have reliable redemption arrangements.

The call for input considers the legal, regulatory and operational conditions needed to support the safe and effective use of tokenised gold, including its incorporation in wholesale market use cases, and the development of industry-led market standards to improve interoperability. Like many recent initiatives from the UK government and regulators, it highlights the increasing momentum behind the development of tokenised asset markets and the importance that industry places on unlocking the use of tokenised securities and commodities in particular for collateral and settlement purposes. As tokenised gold may engage multiple regulatory regimes depending on the use case and participants involved, the FCA is seeking views on areas that may present challenges.

In addition to collateral and settlement, another specific area the FCA seeks feedback on is whether uncertainty around the collective investment scheme and alternative investment fund regimes regulatory perimeter may affect the development of certain use cases for tokenised gold, and whether regulatory clarification or alternative policy measures may be appropriate. The regulator raises two policy options that could be pursued: the first being clarification of the existing regulatory perimeter; and the second being a potential targeted exemption from those regimes for the benefit of gold market infrastructure.

The deadline for comments is 23 October. Alongside this call for input, the FCA, together with the Bank of England, has published a feedback statement setting out their joint ambition to support tokenisation in the UK's wholesale financial markets.

The European Parliament's Committee on Economic and Monetary Affairs (ECON) has published a draft report (dated 10 September) and motion for a resolution on the competitiveness of the banking sector in the EU. The report welcomes the European Commission's (EC) July communication on "Competitiveness of the Banking Sector and the Single Market in Banking" but calls for ambitious legislative action to complete the Banking Union, remove unjustified national barriers to the single market and facilitate market-led cross-border consolidation.

Key proposals include:

• Broadening the mandates of the European Supervisory Authorities (ESAs) to include competitiveness and innovation as a formal secondary objective, without prejudice to their primary objective of financial stability.
• Simplifying the capital stack by reducing overlapping buffers and supervisory add-ons, and exploring a significantly simpler regime for small, non-systemic banks.
• Enhancing the small and medium-sized enterprise supporting factor and raising the threshold for qualifying exposures.
• Launching an omnibus legislative initiative to eliminate obsolete, duplicative or excessively burdensome provisions, and empowering the ESAs to challenge disproportionate national gold-plating.
• Encouraging banks to deploy AI in areas such as creditworthiness assessments, fraud prevention and risk management.
• Clarifying the interaction between the AI Act and sectoral financial services legislation and shaping the regulatory framework for digital assets and tokenisation to preserve the EU's role in global finance.

The EC's detailed package of proposed legislative reform is expected in Q1 2027.

The Central Counterparties (Transitional Provision) (Extension and Amendment) Regulations 2026 have been laid before Parliament, accompanied by an explanatory memorandum. The Regulations extend the transitional provisions for overseas qualifying central counterparties (QCCPs) under Article 497 of the UK Capital Requirements Regulation by a further 12 months, to seven years after an application for recognition was made. This extension aims to ensure that UK firms with indirect exposures to these overseas CCPs do not face a sudden and disruptive increase in their capital requirements upon expiry of the QCCP transitional regime, which the explanatory memorandum notes for some CCPs within the regime could otherwise fall as early as 31 December.

As part of broader efforts to modernise the UK regulatory framework for UK and overseas CCPs, the government has already announced proposals for a new permanent framework for determining QCCP status. This would replace the current QCCP transitional regime. HM Treasury intends to legislate to implement these reforms later in the year.

The Regulations also make consequential amendments to the Financial Services and Markets Act 2023 (Commencement No. 15 and Saving and Transitional Provisions) Regulations 2026 to ensure that the saving and transitional provisions in that instrument in respect of QCCPs align with the extended expiry date.