The European Banking Authority (EBA) has published four consultation papers under the revised Deposit Guarantee Schemes Directive (EU) 2026/804 (DGSD3), aimed at strengthening depositor protection, preserving financial stability and further harmonising depositor protection standards across the EU.

The four consultation papers include:

• Draft implementing technical standards (ITS) on depositor information, setting out harmonised content and formats for depositor information sheets provided at account opening and on a regular basis. They also establish requirements for communications to depositors in specific situations, such as bank mergers or failures.
• Draft ITS on information exchange, introducing standardised procedures, templates and minimum requirements for information exchange in bank failure scenarios. They also enhance reporting from deposit guarantee schemes (DGSs) to the EBA on covered deposits and available financial means, define information to be reported by authorities on bank failures, and improve transparency on the use of DGS funds.
• Draft regulatory technical standards (RTS) on the treatment of client funds, establishing rules to ensure DGSs receive the data needed to identify and reimburse clients whose funds are held in intermediary accounts, clarifying: (i) when reimbursement should be made directly to clients or via the account holder; and (ii) how to prevent duplicate payouts.
• Draft guidelines on the investment of available financial means, setting out how DGSs should invest their funds to ensure diversification, low risk and sufficient liquidity.

The deadline for comments on all of the four consultation papers is 23 October, with a public hearing scheduled for 24 September.

The UK Competition and Markets Authority (CMA) has published updated guidance on the unfair contract terms provisions in Part 2 of the Consumer Rights Act 2015 (CRA), which protect consumers from unfair contract terms and notices used between businesses and consumers. This follows the consultation in January, which focussed on simplification, presentation, style and readability. The CMA confirmed in its consultation that it would not be substantively revising its interpretation of the law, though it did set out developments in case law. The provisions apply to contracts entered into, and relevant notices issued, on or after 1 October 2015 across the UK. The guidance was published alongside a technical note and an updated webpage reflecting the changes.

The guidance is intended to help businesses comply with unfair contract terms law and assist advisers, enforcers and consumers in understanding which contract terms and notices may be unlawful or unfair. It also states that the CMA will have regard to the guidance when exercising its direct consumer enforcement powers under the Digital Markets, Competition and Consumers Act 2024, although any assessment of whether a term or notice is unlawful will continue to be made on a case-by-case basis. The accompanying technical note explains the legislative background to the regime and its interaction with other consumer protection legislation, while the updated webpage provides businesses with practical guidance on drafting fair and transparent consumer contracts.

The UK Financial Conduct Authority (FCA) has published the findings from its review of financial crime systems and controls across asset management and alternative firms. In 2025/26, the FCA engaged with 242 asset management and alternatives firms to gather firms' own assessments of the financial crime risks they face and to understand their control frameworks. The FCA has summarised its main findings, including examples of good and poor practice. It also reminds firms of the FCA's expectations. The FCA's findings centre on how well firms: (i) understand their inherent financial crime risk; and (ii) identify, mitigate and manage financial crime risk (control risks). The review covered a range of business models, and the FCA notes that not all findings will be applicable to all firms given the diversity of the sector. The review is part of the FCA's wider financial crime supervisory work in support of its 2025–30 strategy and supervisory priorities for the sector.

The FCA found that:

• Inherent risks—some firms were exposed to heightened financial crime risks, especially those firms active in private markets, due to factors such as complex ownership structures, higher-risk customers and international fund flows. The FCA expects firms that face higher financial crime risks to have established frameworks and appropriate controls to mitigate these risks, as referenced in the Money Laundering Regulations 2017 (MLRs) and Senior Management Arrangements, Systems and Controls (SYSC) section of the FCA's Handbook.
• Control risks—most firms showed they understood legal and regulatory requirements through their control framework, but others appeared to underestimate their inherent financial crime risks, resulting in an informal approach to evaluating and managing them. The FCA sets out examples of good and bad practice relating to business-wide risk assessments, customer risk assessments, customer due diligence and enhanced due diligence, ongoing monitoring, screening, governance and training. In some instances, the FCA states that the findings were concerning and will require firms to review their financial crime frameworks to ensure they are adequately identifying, managing and mitigating the risks to which they are exposed.

The FCA encourages firms to consider its findings in the context of their own business model and activities and continue to address any gaps in their financial crime control frameworks. The FCA will continue to monitor firms through its supervisory work to make sure they are considering the points raised in this review to drive improvements.

The Financial Action Task Force (FATF) has published a targeted report on the regulatory challenges posed by decentralised finance (DeFi). The report highlights the rapid growth of DeFi and its increasing exploitation by illicit actors, including fraudsters, ransomware operators, professional money laundering networks and proliferation financing actors. The report found that approximately 93% of surveyed reporting jurisdictions have not yet implemented the FATF Standards in relation to qualifying DeFi arrangements and that only two jurisdictions have licensed or registered a DeFi arrangement in practice. FATF reiterates that DeFi arrangements fall within scope of the FATF Standard covering virtual assets—Recommendation 15—where a natural or legal person exercises control or sufficient influence over the arrangement.

The report emphasises that effective implementation of the FATF Standards in the DeFi context requires a functional and risk-based approach. It identifies a list of on-chain and off-chain indicators of control and sets out recommendations to help jurisdictions, as well as financial institutions, virtual asset service providers, and DeFi arrangements aimed at protecting the integrity of the financial system, while also preventing and mitigating the criminal abuse of the DeFi ecosystem. It also includes case studies of good practice. The report emphasises that jurisdictions with more significant DeFi activity should allocate more resources to understanding, supervising and developing approaches to mitigate the illicit finance risks associated with DeFi arrangements.

The EU Anti-Money Laundering Authority (AMLA) has published a final report containing final draft implementing technical standards (ITS) that set out AMLA's cooperation with national financial supervisors to select and directly supervise some of the most significant cross-border financial institutions in the EU. The final draft ITS cover how entities are selected, how supervision passes between national and EU level, and how AMLA and national supervisors will work side by side.

From 2028, AMLA will directly supervise some of the most impactful, cross-border financial institutions at group level. Until now, this supervision has rested with national supervisors. The new ITS will ensure consistent and uninterrupted supervision as responsibility moves between national and EU level.

The final draft ITS set out a clear, step-by-step process for identifying which firms AMLA will supervise: national supervisors gather and quality-check the data, and AMLA carries out the risk assessment and makes the selection, with the results published on its website. When an entity moves to or from AMLA's supervision, the transferring authority hands over the firm's full supervisory history to the receiving authority, preventing disruptions.

The final draft ITS were developed in close cooperation with national supervisors. They are designed for proportionality: entities are asked for detailed data only once they have been identified as eligible. Where supervisors can already establish that a firm does not qualify, it is exempted from reporting altogether. Once adopted by the European Commission, the ITS will apply to the data collection and selection process leading up to the start of direct supervision in 2028.

The European Securities and Markets Authority (ESMA) has published a statement highlighting key deadlines and action points for firms to take when preparing for the transition to a T+1 settlement cycle, which takes effect on 11 October 2027. ESMA states that while readiness surveys conducted by the EU T+1 Industry Committee show an overall good and increasing level of awareness and commitment to the transition, implementation levels remain uneven across EU financial markets, sectors and firms.

While the rules have been known since mid-October last year, ESMA proposed amendments to Commission Delegated Regulation (EU) 2018/1229 to set new requirements, which are particularly relevant for the transition to T+1. ESMA states that firms should consider these in combination with the recommendations of the EU T+1 Industry Committee and accelerate the technical work needed to prepare for the transition to T+1 settlement. The statement also highlights the following key compliance deadlines:

• First deadline: 7 December—for the requirements to improve the first post-trade step, the exchange of allocations and confirmations, in terms of timing and through the default use of international communication standards.
• Final deadline: 11 October 2027—for the requirements to optimise the settlement layer, including sending instructions early enough to securities settlement systems, and the generalisation of certain functionalities in central securities depositories (CSDs), such as auto-partial settlement, hold and release, and auto-collateralisation.

ESMA and the national competent authorities are in the last stages of reviewing the Level 3 guidelines on allocations and confirmations. ESMA considers that the guidelines and the Committee's recommendations will give firms a clear basis for finalising their implementation of electronic, standardised and timely allocation and confirmation processes.

ESMA states that different implementation strategies are possible and firms should undertake thorough analysis and planning, prioritise automation and standardisation, consider new partnerships where relevant, and ensure timely data quality (including correct reference data and standard settlement instructions).

ESMA also reiterates that no-one can be ready in isolation. Firms should assess the readiness of their entire ecosystem, up and down the trading and settlement chain—clients, brokers, custodians, CSD participants, CSDs, central counterparties, trading venues, vendors and outsourcing providers—to enable early testing, identify defects and reduce disruption risk at go-live on 11 October 2027. The regulator warns that insufficient preparedness could trigger significant operational and reputational risks, including flawed interdependencies with financial market infrastructures and IT providers, inability to meet client demands, and higher IT and training costs from last-minute remediation.

The European Commission has published two Delegated Regulations under the Market Abuse Regulation (MAR), in the Official Journal of the European Union (OJ), to reflect amendments introduced by the Listing Act (Regulation (EU) 2024/2809).

• Delegated Regulation (EU) 2026/788 amending Delegated Regulation (EU) 2016/522 to: (i) reflect the broader scope of the exemptions from the prohibition for persons discharging managerial responsibilities to trade during closed periods set out in Article 19(12) of the MAR; (ii) establish a list of designated trading venues that have significant cross-border dimensions for the purpose of implementing the mechanism to exchange order data referred to in Article 25a of the MAR with respect to shares; and (iii) update Annex II on the practices specifying the indicators of market manipulation, to account for technical developments such as algorithmic trading, and to correct a few erroneous cross-references. The Amending Regulation will enter into force on 5 August, being the 20th day following publication in the OJ.
• Delegated Regulation (EU) 2026/789 setting out the requirements on the disclosure of inside information in protracted processes, including the conditions and arrangements for the delay of disclosure. Under Article 17(1) of MAR, issuers must disclose inside information as soon as possible, although Article 17(4) permits delayed disclosure in certain circumstances. The Listing Act amended this regime by excluding intermediate steps in protracted processes from disclosure, provided confidentiality is maintained, and by clarifying when disclosure may be delayed. The Delegated Regulation sets out non exhaustive lists of: (i) final events or circumstances that trigger disclosure along with the timing of such disclosure; and (ii) situations where there is a contrast between inside information whose disclosure is intended to be delayed, and the most recent public announcement or communication by the issuer or emission allowance market participant on the same subject. The Regulation will enter into force on 19 July, being the third day following publication in the OJ.

The Wolfsberg Group has published guidance on the provision of banking services to non-bank payment service providers (PSPs). The guidance is intended to help banks identify, assess and manage the financial crime risks arising from relationships with non-bank PSPs, recognising the increasing complexity of payment chains and the growing role of such firms in the payments ecosystem. It sets out a risk-based framework covering common business relationships, associated financial crime risks, compliance obligations and risk management expectations.

The guidance emphasises the need to: (i) apply a risk-based approach to due diligence and monitor the risks presented by different non-bank PSP activities; (ii) ensure payment transparency through complete and accurate payment information; and (iii) maintain a thorough understanding of a PSP's business model, customer activities and financial crime controls.

HM Treasury (HMT) has published a consultation on updating the Bank of England's (BoE) fee regime under Part 5 of the Banking Act 2009, for recognised payment systems. The proposals would align the regime with the BoE's expanded supervisory remit under the Financial Services and Markets Act 2023 by bringing digital settlement asset (DSA) service providers and related service providers within scope of the fee framework. This will allow the BoE to recover the costs of supervising these entities once they are recognised by HMT.

The consultation also proposes increasing the annual supervision fee cap from GBP760,000 to GBP1.7 million per in-scope provider, in any one year. In addition, the consultation proposes raising the cap on special project fees from GBP500,000 to GBP650,000, per in-scope system in any one year. The deadline for comments is 31 August.

The House of Commons Treasury Committee published a report on the government's Financial Inclusion Strategy following its inquiry launched in November 2025. The Committee concludes that while the strategy is a welcome first step, it does not amount to a comprehensive plan for tackling financial exclusion in the UK. The Committee found that the strategy fails to show who is financially excluded, where exclusion is concentrated, which products and services people are excluded from, or the reasons for exclusion, making it difficult to assess whether HM Treasury (HMT) is making the right interventions. It calls on HMT to publish a fuller quantitative assessment of the scale, causes and distribution of financial exclusion within six months, supported by clearer targets, data and accountability measures. The Committee also recommends that HMT and the UK Financial Conduct Authority develop firm-level metrics for the largest providers and markets where exclusion causes the greatest harm.

The Committee further argues that measures such as establishing working groups, pilots and consultations are not sufficient indicators of success and raises concerns about the extent of industry influence during the strategy's development. While acknowledging HMT's plans to implement industry-led pilots and working groups, the Committee questions whether these initiatives can deliver meaningful change without clear routes to scale and effective evaluation, and calls on HMT to clarify whether, and how, it will intervene if progress proves insufficient, and what the consequences would be. Given that the Financial Services and Markets Bill is currently before Parliament, and the length of time it could take to pass any future legislation, the Committee recommends that HMT consider now whether the Bill should include further targeted powers to intervene if voluntary action fails to secure reasonable access to essential financial services. This includes access to banking services.

The UK Financial Conduct Authority (FCA) has published consultation paper CP26/26, amongst a package of consultations on modernising the UK asset management regulatory framework. The consultation is to be read alongside HM Treasury's proposed reforms to the legislative framework for the UK alternative investment fund manager (AIFM) regime.

The FCA states that currently, different reporting requirements across a range of fund types produce inconsistent data that is difficult to use and interpret, and a burden for firms to report. This consultation proposes a new framework, Fund Reporting for Asset Management Entities (FRAME), which would replace existing requirements with a single, risk-based regime. The proposals are intended to simplify and align reporting obligations more closely with the size, type and risk profile of the fund. The FCA also proposes new reporting requirements on fund holdings in relation to certain UK authorised funds and a new streamlined annual reporting requirement for certain Markets in Financial Instruments Directive (MiFID) investment firms and operators of collective investment schemes that do not currently report to the FCA. This is to address gaps in the data it receives on wider asset management activity.

The FCA published three reporting templates showing the data it proposes to collect from managers and operators of different fund types, on a new webpage, together with a test online version. The FCA proposes to move certain submission processes online and is seeking feedback on this by 31 August. The deadline for comments on the rest of the consultation is 22 September. Final rules are expected in the first half of 2027 and the FCA will confirm the implementation date of FRAME in due course. Its aim is to fully implement the new regime in 2028, but it may explore whether some aspects of reporting could be introduced earlier, depending on firm readiness.

HM Treasury has published the recommendations of the UK-U.S. Transatlantic Taskforce for Markets of the Future, to strengthen cooperation between the UK and U.S. on digital assets and capital markets. In the digital assets space, the recommendations include establishing an industry-led group to test and share best practices on cross-border tokenisation use cases, identifying common approaches to the regulatory treatment of tokenised assets, supporting the development of a cross-border stablecoin market, and coordinating on international standards for the prudential treatment of cryptoassets at the Basel Committee on Banking Supervision. Alongside the recommendations, the UK and the U.S. published a joint statement on stablecoins, underscoring a joint commitment to the digitalisation of finance.

The taskforce's capital markets recommendations focus on reducing cross-border frictions through greater cooperation between UK and U.S. authorities in areas including capital raising, consolidated tapes, audit standards and supervisory cooperation. Progress on the delivery of the recommendations will be reported through the UK-U.S. Financial Regulatory Working Group, to ensure they translate into practical outcomes for businesses and consumers on both sides.

HM Treasury (HMT) has published a consultation on proposed ring-fencing reform following its review published in May. The review found that while the regime remains an important component of UK financial stability, it should be updated to be more flexible, proportionate and responsive to developments. The government confirmed its intention to take forward a package of proposals through primary legislation (as part of the ongoing Financial Services and Markets Bill), secondary legislation and the UK Prudential Regulation Authority (PRA) rulebook.

The government is now consulting on the technical details of implementing the aspects of the package to be delivered via secondary legislation. This covers:

• A new growth allowance, proposed at 10% of a ring-fenced banks (RFBs) Pillar 1 risk-weighted assets for credit risk (including counterparty credit risk). The allowance will incorporate existing small and medium-sized enterprise (SME) exemptions and the relevant financial institution de minimis.
• Expanding the range of products RFBs are permitted to offer, so the ring-fencing legislation on permitted derivatives will be brought into line with Basel 3.1 and permit RFBs to offer customers a wider suite of derivative products which are not in scope of the market risk relevant risk add-on as defined in the PRA Rulebook.
• Expanding the range of counterparties RFBs are permitted to have exposures to, including holding exposures to Undertakings for Collective Investment in Transferable Securities and to Structured Finance Vehicles set up for the purpose of securitising SME loans, amongst others.
• Management of pension schemes.

HMT is also seeking to understand if any further technical changes could be made to address barriers to RFBs supporting the UK real economy.

The deadline for responses is 8 September. The government will consider feedback before publishing a draft statutory instrument; the final instrument will be laid in 2027, following Parliament's approval of the Financial Services and Markets Bill and subject to parliamentary time.

In parallel, the PRA published a consultation paper confirming its intention to consult on deleting rules 9.1, 9.2 and 9.3 of the Ring-fenced Bodies Part of the PRA Rulebook.

The UK Prudential Regulation Authority (PRA) has published consultation paper CP10/26 proposing to remove the "continuity of provision of services" requirements, Rule 9 of the Ring-fenced Bodies Part of the PRA Rulebook for ring-fenced banks (RFBs). The PRA also makes certain consequential changes and amends associated material in Chapter 8 of supervisory statement SS8/16.

The shared services rules are intended to ensure that RFBs remain operationally independent and can continue their core activities regardless of the financial position of other group entities. Some requirements also apply to third-party service providers, ensuring that service arrangements are protected from the actions of other group members. However, the PRA states that since the rules were introduced, other frameworks, particularly the Operational Continuity in Resolution regime, have developed and now achieve similar objectives in a more flexible way. Therefore, these rules should be deleted.

The deadline for responses is 14 October, with final rules expected in 2027. In parallel, HM Treasury has published a consultation on its ring-fencing reform package.

HM Treasury (HMT) has published a report outlining key milestones achieved during the first year of the government's Financial Services Growth and Competitiveness Strategy. The government committed to reporting annually on progress in delivering the strategy, which sets out a ten-year plan to support growth and competitiveness in the UK financial services sector. Drawing on industry engagement conducted ahead of the Mansion House speech, the report notes broad support for the strategy's direction but emphasises that its credibility will depend on effective delivery. HMT highlights areas where it considers meaningful progress has been made, including introducing the Financial Services and Markets Bill, the development of a new UK regulatory regime for cryptoassets and strengthening international partnerships.

The UK Prudential Regulation Authority (PRA) has published policy statement PS16/26, setting out its final rules to accommodate HM Treasury's (HMT) overseas prudential requirements regime (OPRR), which will revoke and restate certain Capital Requirements Regulation (CRR) equivalence provisions in UK legislation. HMT consulted on the creation of the regime in July 2025 and published its response in February, in parallel to the PRA's consultation on that same date. The changes are intended largely to maintain the existing prudential framework while ensuring that PRA rules operate effectively under the new legislative regime.

Following consultation feedback from a single joint response, the PRA has made a number of clarificatory and technical amendments, including changes to certain defined terms, as well as minor updates to Pillar 2 instructions, supervisory statements (SoP5/25, SS31/15 and SS4/26) and reporting instructions to reflect the introduction of the OPRR and revocation of the CRR provisions. The amended materials are included in the appendices of the policy statement. Final rules will apply from 1 January 2027 (alongside the implementation of Basel 3.1). This will coincide with HMT's commencement regulations that revoke the relevant provisions of the UK CRR, which are expected to be replaced by the draft Overseas Prudential Requirements Regime (Credit Institutions and Investment Firms) Regulations 2026.

HM Treasury (HMT) has published a consultation on modernising the UK's payment services and electronic money regulatory framework. Given the pace of innovation in new technologies, the government wants to ensure the existing framework under the Payment Services Regulations 2017 (PSRs) and Electronic Money Regulations 2011 (EMRs) can facilitate new forms of payment safely and securely. The Cross Border Payments Regulation and the SEPA Regulation are also within scope of the reforms while the Interchange Fee Regulation 2015 and the Payment Card Interchange Fee Regulations 2015 are out of scope, reflecting ongoing work on card fees.

The consultation considers updates to the PSRs and EMRs, including the extent to which responsibility for setting firm-facing requirements should be delegated to the UK Financial Conduct Authority (FCA). Having found that strong customer authentication standards (SCA), while reducing fraud, created burdensome customer friction, the government has already committed to revoking the SCA-related authentication provisions in the PSRs so that the FCA can adopt more outcomes-based authentication rules. The consultation also sets out the government's approach to the long-term regulatory framework for open banking.

The deadline for responses is 6 October.

HM Treasury (HMT) has published a draft statutory instrument (SI), the Alternative Investment Fund Managers Regulations 2026, and accompanying policy note, setting out proposals to reform the UK regulatory framework for alternative investment fund managers (AIFMs) using powers from the Financial Services and Markets Act 2023 (FSMA 2023). The draft SI repeals and replaces key assimilated legislation governing AIFMs, transferring most firm-facing requirements from legislation to UK Financial Conduct Authority (FCA) rules. The FCA's consultation paper was published alongside the publication of the draft SI.

The assimilated law being replaced by this instrument includes: (i) the Alternative Investment Fund Managers Regulations 2013; (ii) Commission Delegated Regulation (EU) No 231/2013; (iii) Commission Delegated Regulation (EU) No 694/2014; and (iv) Commission Delegated Regulation (EU) No 447/2013.

The proposals include clarifying the definition of an AIF, removing existing legislative size thresholds for AIFMs, reforming the registration regime for smaller firms, exempting certain small, internally managed investment companies, maintaining the National Private Placement Regime (for overseas AIFMs and AIFs) while giving the FCA greater flexibility over reporting requirements for domestic and overseas funds in the UK, simplifying private equity disclosure obligations, and other minor changes to rationalise the regime with how the market functions. On remuneration, the current legislation, which sets out prescriptive remuneration requirements for AIFMs (and some MiFID firms), will be removed and the FCA will be given powers in the new legislation to institute a replacement remuneration regime for solo-regulated firms.

The deadline for technical feedback on the draft SI is 14 October. HMT will consider feedback and set out a timeline for laying the final SI, which it expects in early 2027, subject to parliamentary time. The legislation will commence at the same time as the FCA makes new rules.

The European Commission (EC) has adopted a Delegated Regulation amending the regulatory technical standards (RTS) on the clearing thresholds set out in Delegated Regulation (EU) No 149/2013, to reflect changes introduced by the revised European Markets Infrastructure Regulation (EMIR 3).

EMIR 3 revises the clearing threshold regime by moving from the exchange-traded derivatives (ETD) versus over-the-counter (OTC) distinction to a methodology based primarily on uncleared OTC transactions. Under the new framework, financial counterparties (FCs) must calculate both their uncleared positions and aggregate OTC exposure (cleared and uncleared), while non-financial counterparties (NFCs) need only consider their uncleared positions. The revised clearing thresholds are covered in more detail in our blog covering ESMA's final report. The Delegated Regulation will now be subject to scrutiny by the European Parliament and the Council of the EU. If neither object, it shall enter into force on the 20th day following publication in the Official Journal of the European Union.

The UK Financial Conduct Authority (FCA) published consultation paper CP26/27, amongst a package of consultations on modernising the UK asset management regulatory framework. The consultation is to be read alongside HM Treasury's proposed reforms to the legislative framework for the UK alternative investment fund manager (AIFM) regime.

In this consultation, the FCA proposes a significant overhaul of the remuneration regime for solo-regulated firms. The FCA proposes replacing the existing remuneration codes for AIFMs, Undertakings for Collective Investment in Transferable Securities (UCITS) management companies and MiFID Prudential Sourcebook (MIFIDPRU) investment firms with a single, consolidated remuneration code (SYSC 19AA). The proposals would move away from detailed, prescriptive requirements towards a more outcomes-focused and proportionate framework, placing greater reliance on firms' governance arrangements and management body oversight.

In addition, the FCA proposes to simplify and update definitions and terminology to reflect the new code and the removal of the existing ones, make consequential amendments across the Handbook (including to the glossary, Senior Management Arrangements, Systems and Controls and other relevant sourcebooks), and set out transitional and sequencing arrangements, including how the new code would apply alongside forthcoming changes to the AIFM framework, so that firms are clear about how and when requirements would take effect. The FCA also proposes to revoke existing non-Handbook guidance where no longer relevant and incorporate elements into the new code.

The deadline for comments is 16 September. The final rules are expected to apply the day after the final policy statement is published in Q1 2027. The new code would apply from that date to remuneration relating to performance periods beginning on or after the commencement date. For AIFMs, and to align with the wider AIFM reform, part of which includes changes to the definitions and thresholds used to categorise AIFM firms, the new code would apply in two stages—initially to full scope UK AIFMs from the commencement date in Q1 2027, and subsequently to medium and large UK AIFMs once the AIFM reforms take effect.

HM Treasury has published the Dematerialisation Market Action Taskforce's (DEMAT) implementation plan and updated terms of reference to modernise the UK shareholding framework by removing paper share certificates and replacing them with digital share registers. The plan sets out a roadmap of legislative, operational and market changes for the government to take and what industry should do alongside this to make this work in practice. It confirms that shareholders do not need to do anything in preparation for the new system and that their rights will be unaffected.

Alongside the plan, the government published its response, accepting DEMAT's recommendations and confirming it will legislate to move towards this new model before the end of 2027. The specific date will be confirmed in due course, giving stakeholders sufficient time to prepare. DEMAT is expected to publish a further report next year addressing the next phases of the programme.

The UK Financial Conduct Authority (FCA) has published consultation paper CP26/28, amongst a package of consultations on modernising the UK asset management regulatory framework. The consultation should be read alongside HM Treasury's (HMT) proposed reforms to the legislative framework for alternative investment fund managers (AIFMs), set out in a policy note and the draft statutory instrument (SI) published for technical comment.

Most firm-facing requirements inherited from the EU framework will move from legislation and be transferred to the FCA's rulebook. The FCA's consultation sets out the rules and changes it proposes to introduce in the following areas:

• A new three-tier regime for AIFMs, with requirements calibrated by firm size using net asset value thresholds of GBP750 million and GBP5 billion, replacing the current legislative thresholds.
• Simplification of the regime by removing or reducing detailed, prescriptive requirements inherited from the Alternative Investment Fund Managers Directive, producing a more proportionate framework.
• A clarified scope of regulation and authorisation.
• A new FCA sourcebook titled the "Alternative Investment Funds sourcebook" for managers of unauthorised funds.
• Changes to valuation, leverage, risk management, liquidity management, delegation, investor disclosure and cross-border marketing requirements.

The consultation also includes discussion chapters on depositaries, prime brokers, the business restriction and the prudential regime for AIFMs. Feedback on the discussion chapters is due by 18 September, while feedback on all other consultation proposals, together with the discussion chapter on the prudential regime, is due by 14 October. The FCA intends to publish a policy statement in 2027 and will implement its rules in 2028.

HM Treasury (HMT) has published the financial services AI adoption plan, setting out next steps to accelerate safe AI adoption and innovation in the sector. The plan describes the UK's existing regulatory framework as a major asset and strong foundation for AI adoption but identifies that the core challenge now is not the absence of regulatory support, but its accessibility, consistency and practical application across the sector. The priority is therefore to establish a clear, authoritative single source of cross-regulator guidance, enabling firms to navigate requirements confidently and scale adoption consistently.

The plan sets out ten recommendations to unlock near-term scaling, support consistent adoption and manage systemic risk and competitiveness. They include:

• A comprehensive review of the consumer, competition and wider impacts of financial guidance and advice-like outputs generated by general purpose large language models.
• Consistent consumer disclosure for AI-driven services.
• Voluntary AI incident and "near-miss" sharing across the UK financial sector.
• Exploring the development of a sector-wide financial services AI skills plan.
• Leveraging the HMT consultation on modernising payment services to establish a "trust framework" to support agentic payments protocol.

The plan also sets out broader considerations for the government to address cross-sector barriers that impact financial services, such as AI sovereignty and resilience.

The Central Counterparties (Equivalence) Regulations 2026 have been published, accompanied by an explanatory memorandum. Under Article 25(1) of the European Market Infrastructure Regulation (UK EMIR), certain overseas central counterparties (CCPs) may only provide clearing services to clearing members or trading venues established in the UK where that CCP is recognised by the Bank of England (BoE). In turn, the BoE is only able to recognise a CCP where HM Treasury (HMT) has determined that the legal and supervisory arrangements of the jurisdiction in which it operates are equivalent to those of the UK. These Regulations determine that the regulatory and supervisory regimes for CCPs in Australia, Japan, Hong Kong, India, the United Arab Emirates, South Africa and the United States (for CCPs under Securities and Exchange Commission (SEC) authorisation) are equivalent to the UK regime. The Regulations enter into force on 3 August.

HM Treasury (HMT) has published a report (the first of two) from the Wholesale Digital Markets Champion, Chris Woolard, together with its terms of reference. This first report sets out a framework for developing a tokenised UK wholesale financial markets system and the steps needed to implement the government's Wholesale Financial Markets Digital Strategy. It reviews the current innovation landscape, examines key policy considerations, other jurisdictions' approaches, and the impacts of cross-border issuance and international interoperability.

It identifies immediate industry priorities and corresponding actions for HMT and the authorities to take, shaped by ten identified priorities to be driven over the next 12 months by the Digital Markets Champion Industry Taskforce ("the Taskforce"). To achieve this, the Taskforce will establish action groups across nine areas, with further details on appointments to follow by September. Views on the report are invited by 4 September.

The European Commission has adopted a Delegated Regulation amending regulatory technical standards (RTS) under the Markets in Financial Instruments Regulation (MiFIR) to implement amendments arising from the MiFIR Review (Regulation (EU) 2024/791) and support the establishment of the over-the-counter (OTC) derivatives consolidated tape. The Delegated Regulation amends the RTS in:

• Delegated Regulation (EU) 2017/583 on transparency requirements for trading venues and investment firms.
• Delegated Regulation (EU) 2017/2194 on package orders.
• Delegated Regulation (EU) 2025/1155 to specify the input and output data for the OTC derivatives consolidated tape and remove exchange-traded commodities and exchange-traded notes from the bond consolidated tape.

The Delegated Regulation also corrects an unintended amendment in Delegated Regulation (EU) 2017/587 by reinstating the requirement for investment firms to take reasonable steps to ensure certain transactions are made public as a single transaction, and by removing a provision that had been inadvertently retained.

The Regulation will enter into force on the 20th day following its publication in the Official Journal of the European Union, with the majority of the amendments applying from 1 March 2027.

The UK Financial Conduct Authority (FCA) has published findings from a multi-firm review of approaches to the consumer duty products and services outcome, identifying good and poor practices. The review was conducted across the banking, insurance, payments, asset management, consumer investments, funeral plans and consumer finance sectors.

Areas for improvement in relation to product and design include generic or overly simplistic target market assessments that fail to adequately reflect customer needs or product risks, and firms describing processes for identifying vulnerable customers without demonstrating how products and services had actually been adapted to meet their needs.

On monitoring and review, while many firms had improved the data they collect to assess customer outcomes, some firms did not use management information effectively to trigger reviews.

On distribution and third parties, some firms provided only generic explanations of their distribution strategies or focused on third-party due diligence without demonstrating how they assessed the suitability of distribution channels. The FCA states that firms should use these findings to reflect on their own products and services and identify where they should make improvements.

HM Treasury has announced the designation of four major cloud services and technology providers as critical third parties (CTPs) under the Financial Services and Markets Act 2023, with effect from 13 July. The designation brings these providers within a new oversight regime under which the Bank of England, UK Prudential Regulation Authority and UK Financial Conduct Authority will jointly oversee the critical services they provide to the UK financial sector. The regime is intended to strengthen operational resilience as financial institutions become increasingly reliant on cloud and technology providers, enabling regulators to gather information, assess resilience and, where necessary, make and enforce CTP-specific rules.

The House of Lords has announced the conclusion of committee stage scrutiny of the Financial Services and Markets Bill following six days of detailed examination. During the final day of committee stage, members considered amendments relating to tokenisation in wholesale financial markets, regulation of the digital asset sector, improving public understanding of financial services, and financial services dispute resolution. The Bill will now proceed to report stage, where further amendments may be considered.

The European Securities and Markets Authority (ESMA) has published its final report with final regulatory technical standards (RTS) on the elements that central counterparties (CCPs) should consider when setting admission criteria for clearing members. The RTS were developed under the revised European Market Infrastructure Regulation (EMIR 3), which amended the CCP participation requirements framework, including by allowing for non-financial counterparties (NFCs) to become clearing members, subject to requirements. The RTS do not prescribe specific admission criteria; instead, they establish a harmonised set of factors that CCPs should take into account when assessing the applicants, including NFCs, and designing their participation requirements. The final draft RTS considers the feedback received through ESMA's October 2025 consultation and public hearing. The RTS have been submitted to the European Commission for endorsement and will subsequently be scrutinised by the European Parliament and the Council of the EU.

The Bank of England (BoE) has published a policy statement confirming its fees regime for the supervision of financial market infrastructures (FMIs) for the 2026/27 fee year. Following the April consultation, the BoE has adopted its proposals as consulted on and confirmed the supervisory fees payable by central counterparties (CCPs) and central securities depositories (CSDs). The BoE's FMI levy will increase by 3% from the 2025/26 budget to GBP18 million. There is a 3.2% reduction for UK CCPs fees and an increase of 7.7% for UK CSDs compared to 2025/26. The statement also confirms an extension to the phased recovery period for costs associated with developing the UK CCP rulebook, with the 2026/27 recovery instalment remaining at GBP1.5m and any excess costs to be recovered in 2027/28. In addition, the BoE expects to begin levying supervision fees for firms participating in the Digital Securities Sandbox during the 2026/27 fee year. Invoices for FMI fees are expected to be issued before the end of August for the 2026/27 fee year.

The UK Financial Conduct Authority (FCA) and UK Prudential Regulation Authority (PRA) have highlighted their progress in advancing their secondary competitiveness and growth objective in response to the House of Lords Financial Services Regulation Committee June 2025 report. In a one-year update dated 12 June, the FCA reported on a range of measures it has worked on, aimed at supporting UK competitiveness, including capital markets reforms, initiatives to improve retail investment and mortgage access, expanded innovation services, reduced regulatory reporting burdens and more streamlined supervisory and authorisation processes. Looking ahead, the FCA identifies further focus areas including open banking and open finance, tokenisation and investment reforms, and broader market initiatives.

Separately, in a letter dated 28 June, the PRA outlined progress in embedding the objective through prudential reforms designed to improve proportionality and reduce unnecessary burdens, including the strong and simple regime for smaller banks, changes to reporting requirements, reforms to capital and resolution frameworks, and initiatives to support investment and operational efficiency. The annex to the letter provides more information on the PRA's response to each of the Committee's recommendations it had set out to the PRA. Both regulators emphasised that promoting competitiveness and growth must remain consistent with their primary objectives of maintaining financial resilience, market integrity and consumer protection.

HM Treasury has published a report setting out evidence on the economic and financial value of operational resilience in financial services, with a particular focus on cybersecurity.

The report highlights the growing challenges facing organisations and markets as cyber risk intensifies, identifying an increase in the severity of cyber-attacks and the scale of their consequences. It warns that a small number of severe incidents can lead to disproportionate financial losses, with losses for large firms potentially approaching GBP466 million, significantly exceeding the cost of day-to-day incident activity. The consequences of such losses are becoming larger and more persistent, with potentially lasting effects on affected firms. Beyond financial loss, the impact can extend to customer trust, reputation, and investor confidence, highlighting the importance of resilience.

The report also encourages firms to reframe operational resilience as a source of growth, rather than merely as a compliance obligation or cost. HM Treasury suggests that more resilient firms are better positioned for growth and performance, as they can recover faster and sustain operational momentum. The report cites evidence that more resilient firms outperform their peers in areas such as revenue growth and profitability.

Furthermore, the report notes that, as digital technologies evolve, the scale and severity of cyber threats are likely to increase. Organisations with stronger resilience will be better equipped to modernise systems and adopt new technologies with less disruption. The report also notes that only 10% of organisations report being prepared for AI-augmented cyber threats and that 77% lack essential data and AI security practices.

The report concludes that operational resilience and cybersecurity should be treated as strategic capabilities that support financial, operational and reputational growth. It emphasises the significant value of improving resilience in order to protect firms against increasingly sophisticated cyber threats, including those augmented by AI.

The EU Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) have published its final report with draft regulatory technical standards (RTS) under Article 53(10) of the sixth Anti-Money Laundering Directive (EU) 2024/1640 (AMLD 6). The RTS establish a framework for assessing the gravity of breaches, determining the level of pecuniary sanctions and administrative measures, and imposing periodic penalty payments (PePPs). They set out indicators for assessing breaches, classify breaches into four levels of severity, and establish criteria for determining sanctions and other measures. They also include provisions relating to natural persons, including senior management and supervisory board members, and procedural aspects for the imposition of PePPs.

Following the February consultation, AMLA made targeted amendments, including clarifications on the application of the framework to non-financial sector firms, confirmation that category 3 and 4 breaches constitute "serious, repeated or systematic" breaches for the purposes of AMLD 6, and revisions allowing supervisors to rely on any reliable and relevant information when assessing breaches. The draft RTS will now be submitted to the European Commission for adoption before publication in the Official Journal of the EU.

The UK Financial Conduct Authority (FCA) has published an information document for firms seeking authorisation under the forthcoming Financial Services and Markets Act 2000 (FSMA) cryptoasset regime. The document outlines the information that firms will need to provide in the cryptoasset authorisation application form when the application gateway opens on 30 September. The FCA notes that the form is still being finalised and will be available through its online system from that date. While it does not expect the structure and content of the form to change, there may be changes to the detail of the wording of the question and the level of explanation required.

Applications will cover both standard authorisation requirements and cryptoasset-specific requirements tailored to the regulated activities being undertaken. While all the cryptoasset-specific sections and questions are included in this document, firms will only need to complete those that are required for their business model. The document will also assist existing FSMA-authorised firms seeking a variation of permission to undertake new regulated cryptoasset activities.

The FCA states that the document is provided on a best endeavours basis for information only and does not constitute guidance or legal advice. Firms remain responsible for ensuring the accuracy and completeness of their applications. The FCA also published an updated financial data template, which firms must complete as part of the application process.

For further background, you may wish to read our blog post titled "Final rules for new UK crypto regime".

The European Securities and Markets Authority (ESMA) has announced it is launching a common supervisory action (CSA) on the digital operational resilience of crypto-asset service providers (CASPs), with a particular focus on custody services. The CSA will assess the maturity of CASPs' operational resilience frameworks in relation to custody activities, focusing on risks inherent to distributed ledger technology (DLT). These include governance arrangements, key and storage management, transaction controls, incident detection and response, smart contract risks, and reliance on third-party providers.

National competent authorities will conduct the review on a risk-based sample of authorised CASPs between the second half of this year and the first half of 2027. ESMA will consolidate the findings into a final report for its board of supervisors following completion of the exercise in the second half of 2027.

The UK Prudential Regulation Authority (PRA) has published policy statement PS17/26 confirming the final regulated fees and levies for 2026/27. The PRA received no responses to its April consultation and confirmed that only minor changes have been made to the draft policy. The PRA';s total funding requirement is finalised as GBP345.3 million, being GBP1.3m lower than proposed in the consultation. The reduction reflects a reduced budget requirement for workforce adjustment costs. The PRA also made a small adjustment to its annual funding requirement to account for lower-than-expected model maintenance fee income arising from the correction of an earlier fee allocation error. The amended PRA fees rules will take effect on 13 July.

The European Banking Authority (EBA) has published a final report with draft implementing technical standards (ITS) on the implementation of international financial reporting standard (IFRS) 18 in supervisory financial reporting (FINREP) under the Capital Requirements Regulation (CRR). IFRS 18, which replaces International Accounting Standard (IAS) 1 and applies from 1 January 2027, introduces a new structure for statements of profit or loss. The final report sets out the amendments required to align FINREP with IFRS 18, including amended versions of the relevant reporting templates which can be found in the press release.

The EBA also published an opinion providing guidance on how institutions can report profit or loss information during the interim period between the first application date of IFRS 18 and the first application date of the amending ITS on the supervisory FINREP (which is currently under consultation until 10 July). While institutions must apply IFRS 18 in their public financial statements from 1 January 2027, the amended FINREP ITS incorporating IFRS 18 are expected to apply from the end of September 2027. To bridge this gap, the EBA advises competent authorities to allow institutions to use a set of IFRS 18-aligned FINREP templates on a voluntary basis during the interim period, thereby avoiding the operational burden of maintaining two different profit or loss reporting frameworks.

The data point model and the XBRL taxonomy based on the revised templates for the implementation of IFRS 18 will be published by the end of July, or at the latest at the beginning of September. The final report will be merged with the final report on the supervisory FINREP, which the EBA expects to submit to the European Commission by the end of the year.

The Bank of England's (BoE) Financial Policy Committee (FPC) has published its July financial stability report alongside the record of its 26 June meeting. The FPC meets to identify risks to financial stability and agree policy actions aimed at safeguarding the resilience of the UK financial system.

Key topics covered include:

• Markets: Vulnerabilities in risky asset valuations, sovereign debt markets and risky credit markets, including private credit, remain and some have become more pronounced since the December 2025 financial stability report. Notably, there has been a substantial increase in the use of leverage in equity markets.
• AI-related risks: The FPC examined the macro financial risks arising from the AI transition across a range of sectors. It also notes that recent rapid advances in frontier AI capabilities have increased financial stability risks related to cyber and operational resilience.
• Countercyclical capital buffer (CCyB): The FPC maintained the UK CCyB rate at its neutral setting of 2%.
• Private markets: The FPC welcomed the BoE's publication of the stress scenario for the private markets system wide explanatory scenario (SWES). The FPC expects to use the SWES to improve its understanding of how banks and non-banks active in private markets would respond to a severe but plausible global downturn.
• Bank capital reform: Following its review of bank capital requirements, the FPC announced that it will work with the UK Prudential Regulation Authority (PRA) to modernise the capital framework. The proposed reforms aim to improve the usability of capital buffers and make leverage ratio requirements more proportionate and effective while maintaining overall financial system resilience. 
• Stablecoins and money market funds (MMFs): The FPC welcomed the BoE's policy statement and consultation on the draft code of practice for systemic sterling-denominated stablecoins and recent statements by HM Treasury and the UK Financial Conduct Authority on their plans to strengthen the resilience of MMFs.

The European Banking Authority (EBA) has published its final report on the guidelines on the authorisation of third-country branches (TCBs) under Article 48c(8) of the Capital Requirements Directive (CRD), as amended by CRD VI (Directive (EU) 2024/1619). Following the November 2025 consultation, no changes have been made by the EBA.

The guidelines set out: (i) the list of information to be included in the application, concerning matters such as the business plan, capital endowment, liquidity, internal governance, booking arrangement and reporting requirements and information about head undertaking(s), in particular their compliance with prudential requirements and a reasoned, third party legal opinion stating that there is no obstacle for the applicant head undertaking to comply with EU and national law, in as much as applicable, in relation to the TCB.; (ii) the procedure for authorisation, as well as standard forms and templates for the provision of the information required; (iii) the conditions for granting authorisation; and (iv) the conditions under which competent authorities may rely on information that has already been provided in the process of any prior third-country branch authorisation. The guidelines will be translated into the official EU languages and published on the EBA website. Competent authorities will have two months from the publication of the translations to report on whether they comply, intend to comply or reasons for non-compliance. The guidelines will apply from 11 January 2027.

The European Systemic Risk Board (ESRB) has published a warning issued on 25 June on the systemic cyber risks posed by frontier AI models. The warning highlights how frontier AI models are transforming the cybersecurity landscape by enabling threat actors to increase the speed, scale, and sophistication of cyber-attacks in the short to medium term. The ESRB urged all EU stakeholders, including financial institutions, to enhance their cybersecurity capacities and encouraged relevant authorities to reflect these risks in their supervisory and oversight work.

On the same date, the European Supervisory Authorities (ESAs) published a press release welcoming and supporting the warning. The ESAs raise concerns that AI-enabled cyber-attacks could threaten the operational resilience of financial institutions. In their view, while the Digital Operational Resilience Act (DORA) and the EU AI Act provide a strong regulatory foundation for managing these risks, they urge financial entities to strengthen their cybersecurity arrangements and call on competent authorities to reflect these developments in their supervisory activities. They also reiterate the ESRB's call on the EU to scale up its capacity, expertise and strategic autonomy in this critical area, which requires all parties to be involved, including AI providers, software providers, security firms, open-source maintainers, financial institutions, and authorities at both national and Union level.

The ESAs are working closely with the EU supervisory community to oversee that risks are identified and mitigated in line with the requirements of DORA. They are also engaging with critical ICT third-party providers on the measures they are taking to adapt to the situation to manage risks.

The UK Financial Conduct Authority (FCA) has published its second edition of its Enforcement Watch newsletter, explaining how it is using supervision and enforcement to drive compliance with the consumer duty. The FCA notes that nearly three years after the duty's implementation, it has opened 11 investigations into potential breaches, up from six reported in the first edition. These investigations span the insurance, pensions, wealth management, consumer investments, peer-to-peer lending and claims management sectors.

The FCA uses this edition to help shine a light on the threshold between assertive supervision (intervening where concerns are identified) and taking enforcement action. The FCA states that where interventions are sufficient to address the harm, there may be no need for a formal enforcement investigation.

A key focus of the FCA's 11 open investigations is whether consumers received fair value in accordance with the FCA's Handbook rules and the consumer duty. The FCA emphasises that fair value is not solely a question of price; products that fail to meet customer needs, cause foreseeable harm or provide little meaningful benefit are unlikely to represent fair value. Given the overlap between the duty's outcomes, the FCA may also examine whether products were designed for an appropriate target market, met that market's needs, were communicated clearly to consumers throughout the product lifecycle, and consumers were given support when issues arose.

The FCA also outlines the types of investigations it has opened and notes that it has "taken the unusual step" of publicly announcing two investigations in the motor finance claims sector to enable affected customers to consider their options, including whether to complain. The FCA expects firms to maintain high standards, proactively identify and prevent consumer harm, and demonstrate good consumer outcomes. While the FCA will work pragmatically with firms that do the right thing, it emphasises that it will take enforcement action where necessary.

Commission Delegated Regulation (EU) 2026/807 amending the regulatory technical standards (RTS) set out in Delegated Regulation (EU) 2023/206 was published in the Official Journal of the European Union (OJ). The Amending Regulation is technical in nature and updates the RTS to ensure consistency with changes introduced to the Capital Requirements Regulation (EU) No 575/2013 (CRR) by Regulation (EU) 2024/1623 (CRR3). It was initially adopted on 10 March, and we cover the amendments it made on our blog here. The Amending Regulation is based on final draft RTS developed by the European Banking Authority and published in December 2025. It will enter into force on 28 June, being the 20th day following publication in the OJ.

The European Securities and Markets Authority (ESMA) has published a new supervisory briefing on triangular passporting under the EU Markets in Financial Instruments Directive (MiFID II), which aims to clarify the appropriate use of the practice, enhance certainty and improve supervisory consistency. It forms part of the EU's wider simplification drive, seeking to reduce the burden of regulation by setting clear expectations for firms. Triangular passporting occurs where an investment firm authorised in one Member State (Member State A) uses a branch or tied agent in another Member State (Member State B) to provide investment services cross-border into a third Member State (Member State C), under the Article 34 freedom to provide services under MiFID II. The practice is not covered or prohibited under MiFID II, but ESMA recognises that this model can create: (i) compliance complexity for firms (which may need to comply with conduct of business rules in multiple Member States); (ii) investor protection risks (such as determining where complaints should be directed); and (iii) uncertainty over supervisory responsibilities.

ESMA's briefing does not create new legal obligations, is non-binding, and is not subject to a "comply or explain" mechanism, nor does it prescribe a single supervisory approach. However, investment firms using, or considering, triangular passporting may expect greater scrutiny of their approach to the practice, including by national supervisors. Notably, the European Banking Authority has not co-authored the supervisory briefing, so at this stage there is no new guidance on triangular passporting for firms within scope of the Capital Requirements Directive (CRD) or existing Payment Services Directive (PSD2). Currently, CRD and PSD2 make no explicit provision for triangular passporting, but support for it can be found in various supervisory publications, while Recital 56 of the European Commission's proposal for the Payment Services Directive 3 explicitly acknowledges the possibility of triangular passporting.

Under the briefing, ESMA expects firms relying on triangular passporting to notify their home supervisor (in Member State A) and specify which authorised services and activities they intend to provide, using the relevant MiFID II templates related to Article 34. They should regularly review and, where necessary, carry out internal risk assessments of, the model. Firms relying on tied agents are expected to explicitly authorise the tied agent to provide cross-border services on behalf of the firm (given the tied agent's separate legal personality). Firms should not use the structure to engage in "forum shopping" for example, establishing a branch or tied agent in Member State B in order to passport services into Member State C may be considered to circumvent the MiFID II Article 35 branch establishment requirements. ESMA also expects firms to give clients clear information on who is providing the service, which authority supervises it, how complaints can be made, and which redress and compensation arrangements may be available. Clients will be entitled to submit complaints to either the head office or the branch/tied agent that is supplying the service.

On the supervisory side, ESMA expects the home Member State supervisor (in Member State A) to notify the supervisors in Member States B and C of the firm's intention to rely on triangular passporting. ESMA provides some guidance on the responsibilities of the supervisors in Member States A-C but notes that a degree of supervisory cooperation will be required and refers to existing Level 2 measures under MiFID II (Commission Delegated Regulation (EU) 2017/586 and Commission Delegated Regulation (EU) 2017/980) which require supervisors to exchange information and cooperate in any cross-border supervisory activities.

The Bank of England's Financial Policy Committee (FPC) has published a financial stability in focus report proposing reforms to modernise the UK bank capital framework to make it simpler, more effective, proportionate and better calibrated to current risks while maintaining financial resilience. The package aims to address unintended consequences in the leverage framework and strengthen the releasability and usability of buffers.

The FPC reaffirms its assessment from its December 2025 report that an appropriate benchmark for system wide Tier 1 capital requirements remains around 13% of risk weighted assets (equivalent to a Common Equity Tier 1 ratio of around 11%). Since December, the FPC, working with the UK Prudential Regulation Authority (PRA), has progressed its analysis of buffer usability and the leverage ratio, and is announcing a package of reforms informed by the feedback it has received. In this report, the FPC sets out its longer term vision for a simpler capital buffer framework centred on a single buffer that is releasable in stress and can be used without automatic distribution restrictions. As an initial step, the FPC welcomes the PRA statement with its decision to make the other systemically important institution buffers releasable in the event of systemic stress. We cover the PRA's statement in a separate update.

In addition, the FPC and PRA intend to consult on reforms to the leverage ratio framework, including: (i) removing the countercyclical leverage buffer; (ii) increasing the additional leverage ratio buffer for firms with systemic buffers to 50% of corresponding risk weighted systemic buffers in line with international standards; and (iii) reducing the minimum leverage ratio requirement from 3.25% to 3%, and applying a simple general leverage ratio buffer set at 25 basis points for firms subject to leverage requirements. The FPC and PRA will further assess the impact of these proposals on financial stability and market functioning at the Q3 FPC meeting. Separately, the FPC expects to update its assessment of the interaction of capital requirements related to domestic exposures in its Q4 2026 financial stability report.

The UK Financial Conduct Authority (FCA) has published the findings of a mystery shopping exercise assessing how effectively firms promoted awareness and helped consumers access basic bank accounts (BBAs), outlining good and poor practice. The FCA found that while firms delivered good outcomes, inconsistent and poor practices are still widespread. Specifically, three themes stood out:

• Firms did not consistently mention and discuss BBAs early enough in the conversation.
• For consumers who did not have standard identification or a fixed address, staff often did not clearly explain what alternative evidence of identification consumers could use or what next steps they needed to take.
• Staff often did not recognise and respond to characteristics of vulnerability or adapt their approach for consumers who needed help to complete a standard or digital journey.

The FCA states that this creates a risk of firms preventing people from getting an appropriate account which can deepen financial exclusion. In response, the FCA has required firms to implement remedial plans and, through UK Finance, the firms have agreed a clear commitment to: (i) improve the identification and promotion of BBAs; (ii) reduce barriers for consumers with non-standard identification or no fixed address; and (iii) recognise and enhance support for vulnerable customers. The FCA will monitor progress through firm-specific oversight and sector-wide reviews and has indicated that it may take further action if sufficient improvements are not achieved.

The UK Prudential Regulation Authority (PRA) has published a statement clarifying that it may release other systemically important institution (O‑SII) buffers during periods of systemic stress. Consistent with the Bank of England's Financial Policy Committee's vision to modernise the bank capital framework, and as a near-step in support of that vision, the PRA intends to do so by exercising its existing powers to vary O‑SII buffer rates. This includes reducing them to zero under the Capital Buffers and Macro-prudential Measures Regulations 2025 while engaging with the FPC. The PRA explains that releasing O‑SII buffers would lower the capital threshold at which automatic distribution restrictions apply in stress, which in its view will support banks' ability to absorb losses rather than taking defensive actions such as reducing lending.

The PRA states that, following any release of the O-SII buffer, it would provide an indicative period during which no increase in O‑SII buffer rates would be expected, and that any subsequent rebuild would be phased over a period consistent with banks' ability to restore capital while continuing to lend to creditworthy UK households and businesses.

The PRA intends to consult later this year on proposed changes to its statement of policy on the approach to implementation of the O-SII buffer and related aspects of its approach to varying O-SII buffer rates in the event of systemic stress. This will include further guidance on rebuild expectations. The PRA will also consider whether greater clarity on the use of the PRA buffer outside periods of systemic stress, together with further engagement with investors and rating agencies, could improve the usability and understanding of regulatory capital buffers.

The European Central Bank (ECB) has published an open letter to CEOs of significant institutions on AI related cybersecurity threats. The ECB warns that advances in AI are accelerating vulnerability discovery and exploitation, marking a long-term shift in the cyber threat landscape rather than a temporary or tool-specific risk. The letter identifies bank management bodies as primarily responsible for responding to the evolving cyber risk, suggesting they may need to revisit ICT investments, resource allocation and bank information and communication technology (ICT) risk-tolerance frameworks, and strengthen governance and control systems where necessary.

The ECB expects significant institutions to assess the impact of the evolving threat landscape and to develop a comprehensive action plan to strengthen relevant controls. The plan should build on existing cyber-risk strategies, cover short- and longer-term measures, allocate resources, assign responsibilities and set implementation timelines. The action plan must be submitted to the respective joint supervisory team (JST) by 31 October after which the JST will discuss the plan with the bank and monitor progress.

In the short term, the ECB expects banks to prioritise vulnerability and patch management, monitoring and detection, AI-enabled defensive capabilities, third-party ICT risk management, and protection of perimeter technologies and externally exposed ICT assets. Longer-term measures should include reinforcing defence-in-depth and cyber hygiene, modernising legacy or unsupported technology, and strengthening response, recovery, crisis-management and information-sharing arrangements.

The ECB also urges banks to remediate outstanding ICT-related supervisory findings without delay, noting that unresolved weaknesses identified through prior supervisory activity may become increasingly material in the evolving threat landscape.

The ECB confirms that DORA requirements remain highly relevant and that it will extend the deadline for the annual IT Risk Questionnaire from September 2026 to February 2027.  The ECB also notes that the responsible CERT (Computer Emergency Response Team) / CSIRT (Computer Security Incident Response Team) authorities may provide additional guidance. For more information, you may like to read our client bulletin titled "ECB requires significant institutions to address AI-enabled cybersecurity threats".

The UK Financial Conduct Authority (FCA) has published Primary Market Bulletin 64, setting out its findings from a 2025 follow-up review of total voting rights (TVR) disclosures and providing observations on significant transaction notifications under the UK Listing Rules (UKLR). The FCA found that, while most issuers disclosed information relevant to TVRs, some announcements lacked sufficient clarity because they neither contained a dedicated TVR subsection nor made any direct mention of the total number of voting rights. This made it difficult for shareholders to identify the TVR used to calculate shareholding thresholds.

The FCA reminds issuers to confirm TVR figures clearly, use appropriate headline disclosure classifications where possible, and refer expressly to "total voting rights" when such information is included within broader announcements.

The FCA also reported on its review of significant transaction notifications under the UKLR, following the July 2024 reforms that removed the requirement for commercial companies with equity shares to publish an FCA-approved circular and obtain shareholder approval for significant transactions. Instead, companies are now required to notify shareholders under a notification-based regime. The FCA observed differing approaches to the number and presentation of risks disclosed by companies and noted that some issuers relied on overly generic risk disclosures. The FCA reminds issuers that risk disclosures should be tailored to the company, taking into account the nature and circumstances of the transaction, and should clearly articulate the specific risks posed to the company rather than relying on generic descriptions.

On board statements, the FCA noted that some issuers had not used the prescribed wording required by the UKLR. The FCA emphasises that issuers must follow the prescribed text and that bespoke wording that dilutes the intent of the rule is not acceptable. Board statements should therefore include the wording: "the transaction is, in the board's opinion, in the best interests of security holders as a whole". The requirement to use prescribed wording also applies to the fair and reasonable statement in related party transaction notifications under UKLR 8.2.2R(4).

The draft Building Societies Act 1986 (Assimilation to Company Law and Changes to Funding Limit) Order 2026 was published and laid before Parliament, alongside an explanatory memorandum. The draft Order amends the Building Societies Act 1986 (BSA 1986) to align the provisions on common seals and the execution of documents by building societies with the equivalent regime under the Companies Act 2006. Building societies will therefore be able to choose whether to execute documents using a common seal or through authorised signatories, bringing them into line with the more flexible arrangements available to companies.

In addition, under section 7 of the BSA 1986, subject to specific exemptions, at least 50% of a building society's liabilities must be shares owned by individuals (known as "the funding limit"). The draft Order makes provisions to exclude certain sources of funding for the purposes of calculating the funding limit. This includes: liquidity facilities which form part of the BoE's sterling monetary framework; debt instruments issued by building societies to meet BoE's Minimum Requirements for Own Funds and Eligible Liabilities (MREL); and sale and repurchase agreements entered into by building societies using High Quality Liquid Assets held to meet the UK Prudential Regulation Authority's Liquidity Coverage Requirement.

These changes are intended to ensure building societies are not discouraged from practices which support prudent management of liquidity, and that instruments issued to meet MREL requirements are treated appropriately with other excluded regulatory capital instruments. The Order is expected to come into force on 1 January 2027.