Global Regulator & Central Bank News Roundup

The State Bank of Pakistan has launched Cyber Shield, a cyber resilience strategy for SBP-regulated entities covering 2025–2030, intended to strengthen the safety and robustness of Pakistan’s banking and financial system against cyber threats. The strategy sets out a roadmap for financial institutions to strengthen systems and controls to prevent cyber incidents, respond rapidly when threats materialise, and recover effectively to support safe access to financial services. Cyber Shield is structured around five priorities spanning resilience strengthening, governance maturity, sector collaboration, workforce development, and continuous evolution of security practices. Planned measures include a cyber-testing framework using controlled attacks, tiered consolidation of cybersecurity regulations, a cybersecurity maturity assessment mechanism, enhancements to disaster recovery plans to incorporate cyber-risk scenarios, and a roadmap for implementing Zero Trust Architecture for critical banking infrastructure. For systemically important payment systems and Financial Market Infrastructures, the strategy envisages risk-based cybersecurity expectations, designation and assessment of systemically important payment systems, business continuity enhancements targeting a two-hour recovery time objective, and assessment of critical service providers. On cooperation and response capabilities, the strategy foresees a threat intelligence and information-sharing platform, a standardised IT and cyber incident reporting framework, and a multi-year cyber exercising programme, with a Financial sector Computer Emergency Response Team to be established after the information-sharing platform is implemented. SBP also signals initiatives to quantify cyber skills gaps, develop training roadmaps, strengthen oversight and supervisory expectations for third-party risk management, and produce an annual cyber threat landscape report for regulated entities.

The Securities and Exchange Board of India has constituted a Working Group to review the regulatory framework governing ESG Rating Providers (ERPs), following feedback from market participants and other stakeholders on the existing regime. The group includes representatives from issuers, investors and other ESG rating users, domestic and global ERPs, ESG analysts, legal experts and academia. Its mandate covers a comprehensive review of the current framework, consideration of representations received, recommendations to improve transparency, reliability and investor confidence in ESG ratings, and an assessment of international regulatory developments for potential alignment with global best practices in the Indian market context. The Working Group will submit a report to SEBI with findings and recommendations on any required policy and regulatory changes to the ERP framework.

The Astana Financial Services Authority (AFSA) has issued a Class Modification introducing a new authorisation approach for FinTech Lab applicants, replacing the prior two-stage pathway with a single-stage assessment intended to shorten timelines for admission to the regulatory sandbox. Under the previous model, applicants went through a pre-application stage covering eligibility and fitness and propriety checks, followed by an application stage assessing financial and non-financial resources, proposed candidates, internal control documents, and development and approval of a test plan. From 16 February, assessment is conducted in one stage covering eligibility of the business model, proposed candidates, and financial and non-financial resources. Policies and procedures will no longer be assessed at the authorisation stage, although applicants must submit anti-money laundering and counter-terrorist financing policies and procedures to demonstrate the framework has been developed. FinTech Lab participants may offer services at the supervision stage only once internal controls have been established to AFSA’s satisfaction.

The Japan Financial Services Agency published minutes of the Financial Services Council’s Market System Working Group meeting where members broadly agreed a draft report proposing a package of changes to Japan’s unfair trading framework. The draft centres on expanding the scope of persons covered by insider trading rules, recalibrating how administrative surcharges are calculated to raise deterrence, and bolstering investigative tools for both domestic enforcement and cross-border cooperation. On insider trading, the draft supports extending “related parties” in tender offer contexts beyond the issuer’s officers to specified persons with comparable proximity to the tender offer fact, including certain parent-company officers and other actors such as those with accounting-book inspection rights, statutory authority, contractors and negotiators, and extending coverage to specified related parties of asset management companies where the tender offeror or issuer is an investment corporation. It also proposes redefining “parent company” for insider trading purposes as a company that controls another company’s decision-making bodies, rather than relying on securities report disclosures. On surcharges, the draft proposes (i) for tender offer-related insider trading by tender offerors and related parties, calculating an assumed economic gain using an average post-announcement price increase rate derived from past cases and applying the higher of this approach and the current method; (ii) for large shareholding reporting violations, narrowing surcharge exposure for non-filing to change reports likely to affect market prices, such as changes of 1% or more in ownership percentage (with exclusions for changes considered to have minor impact), while raising surcharge levels by reassessing market impact; and (iii) for market manipulation involving high-speed trading, calculating gains on a per-day basis and lowering the rounding threshold to avoid cases where small per-stock amounts would otherwise be rounded down and escape surcharge. The report also supports higher surcharges where unfair trades use accounts in others’ names, creating surcharges for cooperative acts such as account provision or funding (illustratively set at half of the profits linked to the insider trade), and revising the surcharge reduction regime to reflect the degree of cooperation after an investigation starts, while keeping the overall deduction ceiling aligned with the current 50% reduction for pre-investigation self-reporting. The draft further proposes adding authority to request appearances to handle foreign regulators’ assistance requests in line with IOSCO’s Enhanced Multilateral Memorandum of Understanding requirements, and extending the Securities and Exchange Surveillance Commission’s criminal investigation remit to crimes involving unregistered financial instruments businesses. The chair asked the secretariat to finalise the report with limited edits, and the secretariat indicated it would move forward with system development, including legal amendments, based on the report’s contents and the meeting’s comments.

The International Monetary Fund published a technical assistance report reviewing the Royal Monetary Authority of Bhutan’s fintech regulatory sandbox framework and proposing reforms to make it more targeted, legally robust, and operationally workable. The diagnostic points to unclear strategic objectives, fragmented governance, limited resourcing and coordination, and the absence of a formal risk tolerance framework, with the sandbox not yet delivering live testing outcomes. The report notes that the sandbox’s broad scope has admitted projects that do not require regulatory licensing or are better treated as procurement-style regtech or suptech development, while committee roles and ownership have created overlaps and conflicts that weaken accountability. It highlights that two cohorts have been onboarded but none have conducted live testing with real customers, and that the current operating model faces gaps around entry and exit criteria, monitoring frameworks, and transition pathways to market authorization. The assessment also flags legal and reputational risks linked to letters of admission and regulatory waivers without a clear mandate, and practical obstacles to bank data sharing for testing given data privacy, consent, and security considerations. As next steps, the IMF recommends that the Royal Monetary Authority of Bhutan identify supervisory priorities, conduct a feasibility study on the suitability and scope of the sandbox, and reorganize governance by separating strategic oversight from operational execution and establishing dedicated staffing. It also proposes rebranding the sandbox into a broader innovation facilitation programme that combines live-testing tools with mechanisms such as an innovation hub and tech sprints, alongside clearer eligibility criteria, standardized procedures, explicit restrictions aligned to risk appetite, defined exit pathways, and deeper collaboration with banks and GovTech, supported by regional engagement and targeted capacity building.

The Reserve Bank of Australia has published guidance on the Australian clearing and settlement facility resolution regime and a response to consultation, setting out how it would generally expect to use its crisis resolution powers over domestically incorporated clearing and settlement facilities to manage threats to the continuity of critical services or to Australian financial system stability. The guidance is intended to improve transparency for facilities, participants and other stakeholders and does not have the force of law, with legislation prevailing where inconsistent. The regime applies to all domestic licensed clearing and settlement facilities co-regulated with the Australian Securities and Investments Commission, with resolution powers inserted into the Corporations Act 2001 in September 2024. Resolution is framed as a last-resort option, typically only where a facility’s recovery arrangements have failed or their use is likely to threaten financial stability, and the Reserve Bank is not required to make a formal non-viability declaration before acting. The guidance describes the powers to issue resolution directions, appoint a statutory manager, and transfer shares or business to a consenting solvent third party or a government-owned bridge entity subject to ministerial consent, alongside information-gathering powers and stays on certain contractual rights that do not apply to netting and collateral arrangements protected by the Payments System and Netting Act 1998. In conducting resolution, the Reserve Bank expects to prioritise stabilising the facility and restoring independent viability, generally allocate losses in the order set out in facility rules, prefer private funding where external support is needed, and only consider government funding as a last resort, noting a standing appropriation of AUD 5 billion to support actions taken under resolution powers. The guidance also sets expectations for coordination with ASIC and other Council of Financial Regulators agencies and for public communication during and after a resolution, including announcing the end of the resolution period and publishing a post-resolution report capturing lessons learned.

The three European Supervisory Authorities each published opinions to the European Commission on EFRAG’s technical advice for a simplified set of European Sustainability Reporting Standards under the Corporate Sustainability Reporting Directive, broadly supporting burden reduction while warning that the cumulative package of reliefs and certain deletions could reduce the availability, comparability and decision-usefulness of sustainability data relied on by investors and financial institutions and weaken interoperability with global standards. Across the three opinions, the authorities focus on permanent reliefs that broaden the use of “undue cost or effort”, allow partial metric coverage, and relax requirements for forward-looking reporting. EIOPA and the EBA each recommend introducing a three-year time limit, through financial year 2029, for reliefs that would otherwise allow undertakings to avoid providing metrics (including for own operations) on a permanent basis, citing risks to data quality, comparability and incentives to improve reporting. ESMA similarly recommends making several permanent reliefs temporary through financial year 2029, including the “undue cost or effort” relief for metrics and partial metric coverage, and also proposes time-limiting the ability to omit quantitative anticipated financial effects where the undertaking lacks skills, capabilities or resources. ESMA additionally recommends time-limiting the exclusion of joint operations from environmental metrics, while the EBA recommends disregarding that joint-operations relief due to the burden it would shift to users. On anticipated financial effects, the opinions emphasise that quantitative information is essential and warn that reliefs and phase-ins could delay comprehensive quantitative disclosures until financial year 2030 for Wave 1 companies. EIOPA and ESMA call for tighter conditions and clearer guidance so reliefs are used only when substantiated and not in areas where quantitative metrics are commonly available, while the EBA highlights the combined effect of transitional provisions and permanent reliefs and recommends time-limiting the “financial effects not separately identifiable” relief. The authorities also propose targeted changes to support consistency and guardrails: EIOPA asks for clearer alignment of insurers’ ESRS financial materiality assessments with Solvency II risk assessment processes, urges retaining more decision-relevant disclosure on risk management and internal controls over sustainability reporting, flags the implications of allowing estimated data without prioritising direct data, and stresses the need to keep “Principal Adverse Impacts” datapoints available, including in voluntary standards, given proposed changes to the Sustainable Finance Disclosure Regulation and the reduced scope of mandatory reporting. The EBA urges the Commission to maintain the gross greenhouse gas emissions intensity metric and to tighten the acquisitions and disposals relief to avoid structuring incentives, while ESMA highlights greenwashing risks from selective use of ESRS by voluntary adopters and recommends additions and clarifications including governance sustainability expertise disclosures, clearer treatment of certain sustainability topics, and stronger disclosure of significant financial resources allocated to actions.

The European Securities and Markets Authority (ESMA) has issued a consultation paper proposing amendments to its guidelines on delaying the public disclosure of inside information under the Market Abuse Regulation, to make them compatible with the Listing Act’s updated disclosure regime. The proposals reflect that, from 5 June 2026, intermediate steps in a protracted process are no longer subject to public disclosure until completion, and that the condition for delayed disclosure has been reframed around avoiding contradiction with the issuer’s latest public announcement or communication on the same matter. Under the proposals, ESMA would delete from Guideline 1 the existing legitimate interests that relate to protracted processes covered by the European Commission’s list of protracted processes, while seeking feedback on whether to retain the current legitimate interest allowing delay where an issuer’s financial viability is in grave and imminent danger and immediate disclosure could jeopardise negotiations for financial recovery. It would add new examples of legitimate interests to delay disclosure, including compliance with a public authority order to maintain confidentiality, time needed to gather objectively verifiable information on an exceptional event such as a major incident or cyber-attack before the market can properly assess it, and protecting sensitive commercial information where disclosure could undermine business opportunities in parallel procurement processes. ESMA also proposes to remove Guideline 2 in full, given the Listing Act’s changes to the delayed disclosure condition and the revised scope of the guideline mandate.

The European Central Bank reported that the Council of the European Union has extended the mandate of Executive Board member Frank Elderson as Vice-Chair of the ECB’s Supervisory Board, keeping him in the role until the end of his Executive Board term. The extension follows a proposal adopted by the ECB’s Governing Council on 17 December and approval by the European Parliament on 10 February after a hearing before the Committee on Economic and Monetary Affairs on 28 January. Elderson’s Executive Board mandate concludes on 14 December 2028.

The European Central Bank has signed a collaboration agreement with the ONCE Foundation for Cooperation and Social Inclusion of People with Disabilities to help ensure the digital euro app is easy to use and accessible for everyone, including people with disabilities, older adults and those with limited digital skills. The ONCE Foundation will support the work by providing technical advice on accessibility requirements and features, collaborating on the app’s design, and testing accessibility of app functionalities once the first prototypes are available. The collaboration is intended to embed an “accessibility by design” approach and to enhance accessibility beyond minimum legal requirements under the European Accessibility Act and standard market practice, with outcomes that could also inform user experience requirements for payment service providers. Accessibility testing will begin when the first app prototypes are ready, with the ECB also continuing to involve the public through activities such as focus groups and market-participant work on digital euro features and onboarding options.

The UK Prudential Regulation Authority has launched a consultation on reforms to the UK securitisation framework for UK-established PRA-authorised firms and relevant parent undertakings. The proposals would make the general requirements less prescriptive and, for Capital Requirements Regulation firms, adjust certain capital and reporting requirements. The package would substantially simplify investor due diligence, introduce an optional “L-shaped” 5% risk-retention modality combining vertical and first-loss retention, and streamline transparency and reporting by moving away from detailed prescribed templates— including by disapplying template-based disclosures and certain regulatory reporting for single-loan securitisations and reducing reliance on securitisation repositories. It also proposes targeted changes to the resecuritisation regime (two safeguarded exemptions from the current ban, with alternative capital treatments for exposures to exempted resecuritisations), clarifies credit-granting criteria to guard against weaker underwriting for securitised exposures, and restructures PRA Rulebook provisions to improve readability. Separately, for internal ratings based firms, it proposes an additional optional treatment for Mortgage Guarantee Scheme and similar “single-loan” mortgage securitisations, allowing an adjustment to the Loss Given Possession component within loss given default models to better reflect the first-loss nature of the guarantee. The Financial Conduct Authority is consulting in parallel on reforms to its securitisation conduct rules in the FCA Handbook. The FCA consultation covers the same core conduct building blocks in broadly aligned form: a more principles-based due diligence regime; streamlined transparency requirements (including removing the public vs private distinction for most transparency purposes); the same additional L-shaped risk-retention modality; a continued resecuritisation ban with narrow exemptions; and clarified credit-granting expectations. On resecuritisation, the FCA indicates that FCA-regulated institutional investors could invest in the two PRA-exempted resecuritisation structures without needing a waiver, while noting the PRA’s safeguards including that the originator and sponsor must be PRA-authorised persons. The FCA also proposes changes to publication of UK Simple, Transparent and Standardised notifications for private securitisations, allowing originators or sponsors to choose whether full details are published.

The Bank of England published a summary of three late-2025 roundtables with representatives from Prudential Regulation Authority (PRA)-regulated firms on responsible adoption of artificial intelligence and machine learning (AI and ML), aimed at understanding constraints on deployment and how the Bank and PRA could support adoption. Participants across challenger and UK-focused larger banks, global systemically important banks and insurers generally supported the PRA’s principles-based, outcomes-based approach, with Supervisory Statement 1/23 on Model Risk Management (SS1/23) cited as enabling responsible innovation. Most did not see a need yet for detailed AI-specific rules or a Bank or PRA AI sandbox, noting the Financial Conduct Authority’s (FCA) Supercharged Sandbox and AI Live Testing as sufficient for testing. The discussions highlighted practical frictions, including cautious second-line risk functions, skills bottlenecks and the challenge of evidencing compliance as generative AI and agentic systems proliferate, with participants questioning whether traditional model validation focused on model interpretability remains sustainable and calling for greater emphasis on testing, monitoring and outcome guardrails. Firms also pointed to cross-border regulatory fragmentation between the UK approach, US expectations (including Supervisory Letter SR11-7) and the EU Artificial Intelligence Act as increasing compliance costs and limiting scalability, and encouraged the Bank to use international fora to support greater coordination. Additional constraints included slow procurement and contracting with third-party AI providers due to uneven understanding of regulated-firm requirements, data protection and emerging data sovereignty regimes (including situations requiring Data Protection Impact Assessments), and insurance-specific data quality limitations that may constrain near-term use cases such as hyperpersonalised products.

The Financial Conduct Authority reported that seven social media influencers have been sentenced at Southwark Crown Court for promoting an unauthorised foreign exchange trading scheme, after pleading guilty to one count of issuing unauthorised financial promotions. The defendants were Biggs Chris, Jamie Clayton, Lauren Goodger, Rebecca Gormley, Yazmin Oukhellou, Scott Timlin and Eva Zapico. The court imposed fines and costs on five individuals, with conditional or absolute discharges for two: Lauren Goodger was fined GBP 3,750 and ordered to pay costs of GBP 5,778.18; Biggs Chris was fined GBP 600 and ordered to pay costs of GBP 1,000; Jamie Clayton was fined GBP 820 and ordered to pay costs of GBP 1,000; Rebecca Gormley received a conditional discharge and was ordered to pay costs of GBP 2,866.42; Yazmin Oukhellou was fined GBP 974 and ordered to pay costs of GBP 1,000; Scott Timlin was fined GBP 938 and ordered to pay costs of GBP 1,000; and Eva Zapico received an absolute discharge and was ordered to pay costs of GBP 1,770.44. The FCA noted that the individuals’ Instagram accounts had a combined following of 4.5 million and referenced its finalised guidance on financial promotions on social media clarifying expectations for firms and influencers.

The Danish Financial Supervisory Authority has launched a project to enable smaller, non-complex Danish credit institutions to be subject to simpler and more proportionate requirements, with the aim of building a national proportionality regime alongside the EU framework. Work will at a minimum cover recovery plans, permissions for redemption of own capital instruments, corporate governance and risk management requirements, and guidance on capital base and solvency needs. A draft updated order and guidance on recovery plans has been sent for public consultation, proposing to move the submission frequency from annual to every three years for firms eligible for simplified obligations, extend simplified obligations to more institutions, and raise the balance sheet threshold for using a capital procurement plan instead of a fuller recovery plan to DKK 2bn from DKK 1bn. The authority also plans to publish sector guidance on simplified approval processes for limited permissions to redeem own capital instruments, intended in particular for small and medium-sized institutions that meet conditions such as capital headroom, and it will consider further simplifications including in light of approaches flagged by the European Central Bank’s Single Supervisory Mechanism. Further proportionality options under the management executive order are expected to be developed into a proposal that could be implemented in 2027, while updated solvency-need guidance is intended to allow simpler methods for calculating capital add-ons and reduce supplementary analysis without lowering risk coverage. The authority will assess whether additional areas can be brought into the proportionality framework and plans to provide a status update at the end of 2026.

The Bermuda Monetary Authority has launched an initiative to reduce regulatory burden in insurance supervision while strengthening efficiency and proportionality, with the stated aim of improving policyholder outcomes. The programme targets unnecessary cost, duplication and administrative friction in reporting, filings and supervisory interactions, while keeping supervisory intensity and escalation strong where risks or weaknesses are identified and without reducing prudential standards, capital requirements or governance expectations. Planned changes include consolidating returns where the same information is captured multiple times, rationalising overlapping schedules, harmonising definitions and continuing development of a common data dictionary to support a “collect once, reuse many times” approach. The Authority also plans to introduce pre-submission validation to reduce avoidable errors and rework, and to make supervisory engagement more predictable by using the secure electronic portal as the primary channel for applications, notifications, document uploads and secure communications, including functionality for insurers to track application status and receive outcomes such as decision letters through a single workflow. Delivery is intended to be shaped through structured, continuous engagement with insurers and other stakeholders, with changes introduced where appropriate through pilots and phased implementation supported by transition arrangements.

The South African Reserve Bank (SARB) has published a consultation paper proposing that the prime lending rate (PLR) should cease to be used as a reference rate in financial contracts and be replaced by the SARB policy rate (SPR), the policy rate commonly known as the repo rate. Under the proposal, banks would quote lending rates as a margin above the SPR rather than the PLR, with no intended change to actual loan pricing outcomes. The paper argues that the PLR has become an administrative rate that no longer represents a base rate for pricing credit, having been a fixed 350 basis points above the SPR since 2001, and that its continued use has contributed to misconceptions about how lending rates and bank profitability are determined. It also states that the PLR does not comply with International Organization of Securities Commissions (IOSCO) benchmark principles and situates the proposal alongside domestic benchmark reforms, including the Financial Sector Conduct Authority’s (FSCA) draft benchmark regulations. For implementation, the SARB envisages adding robust fallback language to new PLR-linked contracts, issuing new contracts that reference the SPR directly, and migrating legacy PLR-linked contracts, supported by stocktaking and, where needed, legislative safe harbour provisions. The scale is described as more than 12 million PLR-referencing contracts with an estimated value exceeding ZAR 3.2 trillion, with retail mortgages and consumer loans accounting for 37% of total exposure; the paper indicates that continuity for legacy contracts would be supported by setting fallback spreads at the current fixed 350 basis points above the SPR to minimise disruption and value transfer. The publication starts a formal public comment process open for one month from publication. The SARB plans further data collection and stakeholder engagement through market forums including the Market Practitioners Group, Money Market Subcommittee and Financial Markets Liaison Group, and expects active transition away from PLR to start no earlier than 2027, after the official cessation of the Johannesburg Interbank Average Rate (Jibar) to avoid overlap.

The Central Bank of Jordan has approved the use of digital identity displayed through the Sanad application as an official means of verifying customer identity across all banks operating in Jordan, to be used as an equivalent alternative to traditional personal identification for banking transactions and services. Use of the Sanad digital identity is intended to support the automation and digitisation of banking operations by enabling customers to complete transactions by presenting their digital identity in-app, using secure electronic verification mechanisms designed to protect data. The Central Bank indicated it will continue working with the Ministry of Digital Economy and Entrepreneurship and other relevant institutions on the broader digital financial services framework. Sanad is described as a gateway to digital government services and requires a smart national ID card, a smartphone with an active mobile number, and an email address to activate a digital identity.

The Saudi Central Bank has opened a public consultation on draft rules that would set a licensing and supervisory framework for cash center management and operation in Saudi Arabia. The draft is intended to establish controls and standards for entities that handle cash receipt, counting and sorting, storage and related processing activities. The proposed framework would require a licence to conduct cash center management and operation, with separate operating licences for each cash center. It sets application requirements including permitted legal forms, integrity and fitness standards, and specified documentation, and includes timelines for responding to information requests and renewal submissions. The draft also introduces governance, staffing and training expectations, information security and financial crime compliance obligations, operational requirements for an electronic cash management and tracking system aligned with GS1 identifiers and cybersecurity requirements, and detailed controls such as dual control for key processes, daily cash reconciliation and discrepancy handling, storage limit monitoring, cash container specifications, monthly reporting to the Saudi Central Bank, and supervisory access and corrective measures up to and including licence revocation. The consultation is open for 15 days. The draft states that the rules would be published on the Saudi Central Bank’s official website and would take effect from the date of publication.

The Dubai Virtual Assets Regulatory Authority (VARA) published a consumer and marketplace alert to clarify the status of Dubai’s real estate tokenisation pilot led by the Dubai Land Department (DLD). The underlying initiative—launched by DLD in March 2025 under the REES programme and implemented with VARA, Dubai Future Foundation and (as described in DLD’s project overview) the Central Bank of the UAE—uses blockchain-based tokenisation of property title deeds to enable fractional ownership and broaden access to Dubai real estate investment, and has been progressing toward controlled secondary-market resale as part of the pilot’s next stage. VARA noted that the initial pilot phase has been completed and the initiative has moved into a controlled Phase 2 testing and evaluation stage (including the assessment of secondary-market mechanisms) under close regulatory oversight and coordination between DLD and VARA. VARA also warned that some entities may be referencing the initiative in promotional or marketing materials without the necessary approvals, or implying participation beyond what has been formally authorised. VARA reiterated that tokenised real estate products offered in or from Dubai—and the related virtual asset activities—remain subject to VARA’s licensing/approval requirements and the applicable legal framework (including Dubai Law No. 4 of 2022 and Cabinet Resolution No. 111/2022), and advised market participants to rely only on formal communications issued by VARA and/or DLD, verify any firm’s status via VARA’s Public Register, and report suspected unlicensed activity to VARA

The Central Bank of Oman has issued a regulation governing the practice of buy now, pay later (BNPL) services, setting a formal supervisory framework to ensure the service is provided in a disciplined and transparent manner. The rules apply to institutions licensed by the Central Bank of Oman to conduct BNPL activities and set out licensing requirements and procedures, capital adequacy requirements, disclosure and transparency standards, risk management mechanisms, and consumer protection obligations.

The U.S. Department of the Treasury has concluded a public-private initiative to strengthen cybersecurity and risk management for artificial intelligence in the U.S. financial services sector and is releasing a series of six implementation-focused resources through February. The first two publications are a shared Artificial Intelligence Lexicon and the Financial Services AI Risk Management Framework. The deliverables were developed through the Artificial Intelligence Executive Oversight Group, convened by the Financial and Banking Information Infrastructure Committee and the Financial Services Sector Coordinating Council, bringing together financial institutions, federal and state financial regulators, and other stakeholders. Workstreams address governance, data practices, transparency, fraud, and digital identity; the lexicon establishes common definitions for AI concepts, capabilities, and risk categories, while the Financial Services AI Risk Management Framework adapts the NIST AI Risk Management Framework for financial services, with tools to evaluate AI use cases, manage risks across the AI lifecycle, and embed accountability, transparency, and resilience in deployment decisions. Treasury will publish the remaining resources in stages during February, with additional deliverables spanning areas including identity, fraud, explainability, and data practices, and will continue engaging regulators, industry, and other stakeholders to advance the President’s AI Action Plan.

The U.S. Department of the Treasury has set out the priorities and in-person meeting calendar for the 2026 G20 Finance Track, confirming that the United States will host multiple Finance Track meetings, including a finance ministers and central bank governors meeting in Asheville, North Carolina. The agenda centers on pro-growth economic policies, with priorities including modernizing financial regulation, strengthening analysis of excessive global imbalances, enhancing debt transparency and facilitating debt restructurings, endorsing a digital assets ecosystem, improving cross-border payments while addressing payments fraud and scams, and promoting financial literacy. The in-person schedule lists meetings on April 16 in Washington, DC for finance ministers and central bank governors; August 29-30 in Asheville for finance and central bank deputies; August 31 to September 1 in Asheville for finance ministers and central bank governors; and October 15 in Bangkok, Thailand for finance ministers and central bank governors. The United States’ G20 host year is set to conclude with the Leaders’ Summit on December 14-15 at Trump National Doral in Miami, Florida.

The Canadian Securities Administrators have adopted final amendments to Multilateral Instrument 25-102 Designated Benchmarks and Benchmark Administrators and related companion policy changes to strengthen assurance report requirements for designated benchmarks. The package clarifies the level and form of assurance to be provided by an independent public accountant, standardises timing and submission expectations, and expands assurance reporting to designated benchmarks that are not commodity, critical or interest rate benchmarks. Changes to MI 25-102 replace prior “limited/reasonable assurance report on compliance” concepts with a “reasonable assurance report on controls” prepared under applicable Canadian or international assurance engagement standards. The amendments revise assurance report requirements for designated critical, interest rate and commodity benchmarks and introduce a new section 13.1 requiring a reasonable assurance report on controls for any other designated benchmark, covering compliance with specified MI 25-102 requirements and adherence to the benchmark methodology. The first report for a designated interest rate benchmark with a benchmark contributor covers a three-month look-back period in months 3 to 6 after designation, while first reports for other in-scope benchmarks generally cover months 9 to 12 after designation, with subsequent reporting on either a 12-month or 24-month cycle depending on benchmark category. Reports must be provided to the benchmark administrator within 90 days after the end of the applicable period, then published and delivered to regulators within 100 days, with parallel provisions for benchmark contributors where an oversight committee requests a report or where periodic contributor reporting applies, including coverage of code of conduct compliance for interest rate benchmark contributors. Subject to required ministerial approvals, the amendments and companion policy changes are scheduled to come into force on May 5, 2026.

The National Association of Insurance Commissioners has adopted its 2026 strategic priorities, setting a work programme for state insurance regulators focused on strengthening oversight in a changing insurance and risk environment. The priorities include finalizing, adopting, and guiding implementation of a new investment and capital regime intended to enhance regulatory oversight and be harmonized across states. The NAIC also plans to deepen its role as a data aggregator and analytics provider to support early warning monitoring, risk identification, peer review, and policy insight. Additional focus areas cover resilience-related regulatory work, including guidance on catastrophe modeling, exposures, stress testing, and climate disclosures alongside coordination with federal and state officials, and technology oversight through frameworks for cybersecurity and insurers’ use of data, a pilot artificial intelligence evaluation tool, and expanded education and training capacity.