Global Regulator & Central Bank News Roundup

Malaysia's Securities Commission (SC) has established the ICM Innovation Lab, dubbed FIKRALab, as a structured co-creation and applied research and development platform to develop new Islamic capital market products and instruments. The initiative forms part of the Capital Market Masterplan 2026–2030 and intended to help advance Malaysia’s Islamic capital market by anchoring innovation on Maqasid al-Shariah and the Halal-Toyyib approach. Specifically, the lab expands the SC’s earlier FIKRA Islamic fintech accelerator and FIKRA ACE facilitation programme beyond fintech-centric innovation, enabling collaboration with industry on ideation, research, product design and pilot testing. A key element is the Maqasid al-Shariah Clinics, combining curated engagement and a knowledge symposium with domain experts to assess and enhance existing Islamic capital market products, strengthen value propositions, and reinforce real-economy linkages, with expected outputs including new use cases, products and supporting infrastructure. Work will proceed in phases, starting with a pilot project underway with a financial institution to develop an instrument aimed at unlocking Shariah-derived income within mixed-activity groups. Applications for the first FIKRALab cohort are anticipated to open in Q4 2026, with cohorts expected to run annually and rotate focus areas, beginning with new-generation Islamic capital market products and services, Islamic social finance and social capital, and sustainability and transition finance. The SC is inviting interested parties to register interest until 30 September 2026.

In a speech on Project Acacia, the Reserve Bank of Australia (RBA) foreshadowed findings from its industry collaboration on tokenisation in wholesale markets and outlined a coordinated work program with the Council of Financial Regulators (CFR), the Digital Finance Cooperative Research Centre (DFCRC) and industry. Project Acacia tested 20 use cases with regulatory relief from ASIC and AUSTRAC, spanning tokenised assets including government and corporate bonds, repos and bank term deposits, as well as investment funds and other assets. Settlement used both tokenised private money (stablecoins and bank deposit tokens) and central bank money (wholesale CBDC and exchange settlement account (ESA) balances), including issuance of wholesale CBDC onto external ledgers. The RBA pointed to DFCRC analysis estimating potential economy-wide gains of around AUD 24 billion per annum, while noting impediments to commercial adoption such as legal and regulatory uncertainty, interoperability challenges and coordination failures. On tokenised money, the speech highlighted the potential efficiency gains from aligning tokenised assets and money on the same ledger over the long run, while suggesting near-term progress could come from synchronisation approaches, including delivery-versus-payment mechanisms linking tokenised asset platforms with the RBA’s Reserve Information and Transfer System (RITS). Looking ahead, the Reserve Bank of Australia said it will work with Council of Financial Regulators agencies, the Digital Finance Cooperative Research Centre and industry to explore a digital financial market infrastructure sandbox to support longer-term testing and scaling, with particular focus on synchronisation with the Reserve Bank Information and Transfer System and interactions between wholesale central bank digital currency, bank deposit tokens and stablecoins. It also flagged a review of exchange settlement account access policies once the first tranche of the Government’s payment service provider licensing reforms has passed Parliament, alongside stepped-up work on wholesale cross-border payments and new industry forums including a Regulator-Industry Tokenisation Advisory Group, an expanded Deposit Token Working Group and an industry C-suite roundtable convened by Council of Financial Regulators agencies.

The Australian Prudential Regulation Authority (APRA) has published its Insurance Climate Vulnerability Assessment, a prudential stress test on how climate change could affect home insurance affordability and the home insurance protection gap for Australian freestanding houses. The exercise finds that the share of households likely to be without home insurance could rise from about one in seven today to about one in four by 2050 under both a higher physical risk scenario and a higher transition risk scenario, increasing uninsured losses for households and potentially amplifying credit risk for banks, slowing insurance market growth and raising pressure for government support after weather events. The assessment was based on modelling by five large general insurers representing around 80% of the home insurance market and treats insurance as unaffordable where annual premiums reach at least four weeks of household income. In the higher physical risk Current Policies Scenario, the main driver of the wider protection gap is rising weather-related losses, with expected annual weather losses increasing from less than AUD 7 billion in 2024 to AUD 16.3 billion by 2050. In the Delayed Transition Scenario, the main driver is construction cost inflation and weaker income growth rather than direct weather losses, although expected annual weather losses still rise to AUD 12.4 billion. The gap remains geographically concentrated, with regional and rural areas more affected than capital cities and New South Wales and Queensland accounting for most uninsured households. APRA says narrowing the gap will require a coordinated response centred on reducing underlying weather peril risk, improving insurance affordability through product innovation or targeted public intervention, and managing resulting prudential risks in banks and insurers.

The Securities and Exchange Board of India has launched a verified label on Google Play for stock trading apps offered by brokers registered with SEBI as an investor protection measure against fraudulent apps impersonating genuine platforms. The move is intended to help retail investors identify apps linked to regulated entities and reduce the risk of being misled into believing their investments are being routed to the regulated securities market. Introduced in collaboration with Google, the measure will initially apply to stock trading apps associated with SEBI-registered entities. Subsequently, it will be extended to apps of other regulated intermediaries.

The Monetary Authority of Singapore (MAS) and the Singapore Bullion Market Association have set out key focus areas to strengthen Singapore’s position as a trusted gold trading centre serving the Asia-Pacific region, responding to growing investor interest in vaulting and trading gold in Singapore. The focus areas were identified by a Gold Market Development Working Group established in January 2026, building on discussions and studies with industry participants in 2025. Planned measures span developing gold-related capital market products to facilitate price discovery and build liquidity, establishing robust and internationally aligned standards for vaulting and logistics, and building a clearing system to support secure and efficient over-the-counter settlement for trading large bar and kilobar gold in Singapore. MAS will also look to provide vaulting services for foreign central banks and sovereign entities. The working group is co-chaired by the MAS and the Singapore Bullion Market Association and includes members from DBS Bank, ICBC Standard Bank, JPMorgan Chase Bank, UBS AG, United Overseas Bank, SGX Group, and the World Gold Council.

The Australian Securities and Investments Commission has opened a consultation on proposed amendments to the ASIC Derivative Transaction Rules (Reporting) 2024, aimed at simplifying reporting, reducing regulatory complexity, improving data quality and supporting continued alignment with international data standards and other major jurisdictions’ reporting rules. The proposed changes include new provisions to require reporting of additional report-level information needed for a derivative trade repository’s data handling, and to permit reporting of data elements that are not required for a particular transaction where reported in the specified formats and allowable values. Clarifications would address technical constraints in the ISO 20022 base message that can prevent certain information being reported in specific circumstances, and refine the definition of “alphanumeric” to specify applicable character sets. ASIC also proposes adding or standardising several data elements, including execution agent of Counterparty 2, a leverage ratio field to support reporting of certain structured derivatives in a single report, schedule data elements for notional quantity, price, strike price and barrier price to enable one-time reporting of schedule information, and barrier type and barrier exercise style where not identified by the reported Unique Product Identifier. Further changes would add a “Subsequent position UTI” field for narrow transaction-to-position conversion reporting, clarify that “Other payment” includes monetary value transfers, adopt standardised identification of underliers reflecting the December 2025 update to international Critical Data Elements guidance, and introduce “EROR” as an action type for collateral reporting.

The Joint Committee of the European Supervisory Authorities published its Spring 2026 cross-sector update on risks and vulnerabilities in the EU financial system. The assessment emphasises elevated geopolitical uncertainty and the rapid growth of private finance as two drivers that could reshape risk profiles and transmit shocks across banking, insurance, pensions and financial markets. Geopolitical developments, including the Iran war, are linked to energy price increases, inflation concerns and a weaker economic outlook, alongside stretched equity valuations, tight credit spreads and higher-for-longer rates that could amplify repricing and liquidity risks and expose sovereign fragilities. Bank profitability and capitalisation are described as strong (return on equity 10.7% and CET1 ratio 16.3% in Q3 2025), but vulnerabilities include high sovereign exposures (around EUR 4tn in H1 2025, 226% of CET1) and pockets of risk in commercial real estate and SME portfolios, while cyber threats and third-party dependencies are flagged as potential sources of disruption to critical financial infrastructure. The update also notes that crypto-asset prices have fallen markedly since October 2025 while stablecoins continued to grow, raising the risk of spillovers to traditional finance in a further downturn. On private finance, the Joint Committee flags emerging vulnerabilities as prolonged growth has outpaced data availability and transparency and complex, opaque interconnections with the wider financial system raise the risk of abrupt shifts in investor liquidity and spillovers. EU private equity and private credit fund assets are estimated at about EUR 0.8tn and EUR 0.1tn (March 2025). The Savings and Investments Union (SIU) is expected to include provisions to increase private equity investment, while banks’ links to private finance—through funding arrangements, derivatives and securities financing transactions, and advisory activities—create additional channels for risk transmission. Recent redemption surges at several flagship US semi-liquid Business Development Company (BDC) private credit funds in Q1 2026, linked to investor concerns as AI pressures traditional software business models, are cited as an example of how quickly sentiment can shift.

The European Parliament has adopted at second reading three legislative acts in the European Union’s crisis management and deposit insurance reform, approving without amendment the Council positions on changes to the Bank Recovery and Resolution Directive, the Single Resolution Mechanism Regulation and the Deposit Guarantee Schemes Directive. The package is intended to make resolution more usable for smaller and medium-sized banks, reduce reliance on taxpayer support, and widen the use of industry-funded deposit guarantee scheme resources while keeping shareholders and creditors as the first line of loss absorption. Under the new framework, deposit guarantee schemes rank first in insolvency or resolution, retail depositors and micro-, small- and medium-sized enterprises rank second, and certain small public authorities rank third, provided they are not professional investors. In addition to the standard EUR 100,000 guarantee, temporary high balances will be protected for six months at not less than EUR 500,000 and, for private residential real estate transaction deposits, up to EUR 2,500,000. The reform also broadens the public interest assessment so smaller banks can be resolved where insolvency would not achieve the resolution objectives more effectively, simplifies the least-cost test by capping deposit guarantee scheme interventions at the gross amount of covered deposits, and allows deposit guarantee scheme funds to help meet the 8% total liabilities and own funds threshold for transfer strategies where a deposit-funded bank lacks sufficient internal loss-absorbing capacity.

The European Insurance and Occupational Pensions Authority and the European Union Agency for the Space Programme have published a joint white paper setting out how open-access Copernicus Earth Observation data could be used to strengthen the supervision of natural catastrophes and assess the impact of extreme weather events on Europe’s insurance sector. The paper draws on a joint pilot project and presents satellite-based Earth Observation as an independent and near real-time source of geospatial information that can complement catastrophe models and insurers’ regulatory reporting. A proof of concept focusing on the July 2021 floods combined Copernicus-derived flood extent and depth with exposure and land cover information, aggregating results at NUTS 2 regional level under the EU statistical classification to align with EIOPA “sum insured” inputs and support supervisory triage through indicative loss estimates and identification of affected undertakings. For Belgium, the tool generated insured flood loss estimates of EUR 1.03 to 1.17 billion versus a EUR 2.20 billion benchmark, with the difference attributed to partial market coverage in the EIOPA dataset of around 70% and methodological constraints such as uniform exposure and damage estimation at NUTS 2 resolution. Beyond floods, the white paper describes potential applications across wildfires, earthquakes, landslides, windstorms and drought, alongside practical information on Copernicus access channels and limitations including the need for specialist processing capabilities and uncertainties linked to cloud cover, revisit times, dense urban resolution and interpretation of satellite-derived outputs. As next steps, the white paper points to a phased integration into supervisory processes, including stronger data lineage and model risk controls, development of shared and open benchmarks for post-event assessment at NUTS 2 level, and scaling through targeted pilots.

The European Central Bank (ECB) has published a Working Paper examining which actors could be brought within the regulatory perimeter for decentralised finance by analysing governance arrangements in major DeFi protocols. The paper, which the authors state should not be reported as representing the views of the European Central Bank, concludes that governance token ownership and voting influence are highly concentrated and that influential decision-makers are often difficult to identify using public information. Using a hand-collected dataset covering Aave, MakerDAO, Ampleforth and Uniswap, the analysis finds that the top 100 governance token holders account for more than 80% of supply across all four protocols, with the top five holders controlling roughly 36% to 59% depending on the protocol and with these distributions broadly stable across October 2022 and May 2023 snapshots. A large share of holdings is linked either to addresses associated with the protocols themselves or to centralised and decentralised exchanges, with exchange-linked holdings ranging from 3% to 22% and Binance the largest centralised holder across the tokens examined, although the data cannot distinguish between exchange proprietary holdings and customer assets. Proposal analysis shows voting most frequently concerns risk parameters (28% of proposals) and asset listings (23%), while governance-parameter changes account for about 1%. Top voters are largely delegates rather than direct token holders, around one third of top voters cannot be identified, and delegated voting power is itself concentrated, with top delegates controlling 52% to 96% of delegated voting power in the protocols where delegation data is available. The paper argues that these identification and accountability constraints weaken the practicality of commonly cited regulatory “anchor points” such as governance token holders, developers or centralised exchanges, and complicate assessments of when services are provided in a “fully decentralised” manner for the purposes of existing frameworks such as the EU Markets in Crypto-assets Regulation. It highlights that improved traceability of ownership and delegated voting, and clearer allocation of responsibility within DAO structures, would be necessary to support more effective supervision based on publicly available data.

Norway's Norges Bank has published four reports from its study on digital central bank money (DSP), concluding there is currently no basis to introduce DSP in Norway while noting the need could change. The reports set out the analysis behind the bank’s decision, announced on 10 December 2025, not to pursue either customer-facing DSP or DSP for settlement at this stage. The work, included in Norges Bank’s 2023–2025 strategy, assessed customer-facing DSP as an electronic form of cash and a settlement DSP available only to banks and other financial firms with central-bank accounts, primarily to support settlement of tokenised transactions in central bank money. Norges Bank judged DSP to be an ill-suited near-term tool to foster payments innovation or strengthen contingency arrangements, citing the complexity and cost of building new infrastructure and the immaturity of supplier solutions and standards. As an illustration of the potential balance-sheet impact of a retail DSP, the report models a NOK 30,000 per-person holding limit and estimates that a full take-up at that cap could reduce household bank deposits by around 7 to 8% and raise banks’ annual funding costs by NOK 1 to 4 billion, implying a 2 to 6 basis-point increase in average lending rates. The reports also highlight growing attention to stablecoins as a potential settlement asset for tokenised securities and cross-border transactions, and argue that a future case for DSP is most likely to arise if tokenisation scales and central banks need to ensure systemically important settlements take place in central bank money. Norges Bank said it will continue investigating tokenisation and different DSP models, including further experimental testing in its blockchain-based sandbox with other payment-system participants, and plans to publish the sandbox code as open source and assess the potential use of Eurosystem solutions and standards.

The Danish Financial Supervisory Authority published its annual survey analysis of Danish financial companies’ perceptions of key risks, finding that cyber threats and geopolitical conditions are viewed as the most significant sources of risk to Denmark’s financial stability. Geopolitics is ranked on a par with cyber for the first time, while respondents continue to express broad confidence that the financial system will remain stable over the next three years. Cyber threats and geopolitical events were also rated as the most difficult to manage and among the most likely to materialise: 70% selected cyber conditions as among the two most challenging risks, while 63% selected geopolitics as among the two most likely and 53% as among the two most challenging. Perceived shock risk has increased, with 47% saying the risk of a significant negative shock over 0-12 months has risen over the past six months; 54% still rate short-term shock risk as low or very low, and 43% as moderate, while over 1-3 years 57% view the risk as moderate and 17% as high. Respondents linked cyber concerns to geopolitical tensions, citing cyberattacks as a tool in conflicts, supply-chain vulnerabilities and concentration of IT providers, and dependence on technology outside the European Union, including potential 'kill switches'. Other highlighted risk themes included 'new technology', linking artificial intelligence to more complex cybercrime risks, and a new focus on 'US government debt'. Firms also pointed to higher-gearing and lower-transparency products as potential risk amplifiers, including private credit, alternative funds and structured credit products, certain 30-year interest-only variable-rate mortgage loans when combined with high loan-to-value, complex illiquid investment products, and crypto-assets. Confidence in stability remained high, with 73% reporting high or very high confidence for the next three years.

The UK Prudential Regulation Authority has finalised changes to recovery planning and resolution reporting intended to make the framework more proportionate while preserving firms’ preparedness for stress and orderly failure. The package raises the Resolution Assessment threshold from GBP 50 billion to GBP 100 billion in retail deposits, reduces the minimum review frequency for Small Domestic Deposit Takers and SDDT consolidation entities from annual to biennial, and finalises targeted amendments to Minimum Requirement for Own Funds and Eligible Liabilities reporting, including changes to MRL001 and MRL003 and deletion of the MRL002 forecast template. The core measures were finalised as consulted, with the MREL package supplemented by technical clarifications and examples. From 1 April 2026, PRA-authorised UK banks and building societies with at least GBP 100 billion in retail deposits will be in scope of the Resolution Assessment rules, and firms newly in scope are expected to submit reports by 2 October 2026. From the same date, SDDTs will review recovery plans at least once every two years rather than annually, but must update them sooner where changes could materially affect the plan, and the PRA expects new and growing banks to review more frequently than the minimum. The PRA rejected calls for a three-year cycle, citing the benefit of keeping recovery plan reviews aligned with biennial ICAAP and ILAAP updates. The MREL reporting changes apply to UK banks, building societies, PRA-designated investment firms and qualifying parent undertakings subject to the Resolution Pack rules where firms have, or are likely to have, MREL above minimum capital requirements or a bail-in or transfer resolution strategy. Revised MRL001 and MRL003 templates take effect on 1 January 2027 and will first be used for 2026 Q4 data submitted in February 2027. Transfer-preferred firms no longer need to submit MRL001 and can stop filing MRL002 immediately, while bail-in firms must continue using the current MRL001 and MRL003 templates and complete only the current-reporting column of MRL002 until that template is deleted on 1 January 2027. Quarterly reporting remains in place because the PRA considers it necessary to monitor firms’ progress in building and maintaining loss-absorbing capacity above minimum capital requirements and to avoid data becoming materially out of date.

The Financial Superintendency of Colombia has set out a public recognition framework for supervised entities that implement ahead of schedule its 2025 instructions on managing environmental and social risks, including climate risk. The measures consist of an early-adoption badge and a public ranking based on the order in which entities demonstrate implementation before the end of the 18-month transition period, which runs until 3 April 2027. Applications may be submitted from 6 April 2026 to 31 December 2026 through the supervisory authority’s document system and must include an explanatory paper of up to 15 pages describing the entity’s policies, procedures, materiality thresholds, governance approval, risk identification, measurement, control, monitoring and staff training. Entities subject to the credit operations section must provide an additional submission of up to 15 pages covering the initial screening filter, loan categorisation methodology, monitoring and enhanced follow-up for high-risk exposures. The assessment will be carried out in two stages: first a documentary review and then a presentation session with the authority. The badge does not amount to certification, approval or validation of the entity’s overall risk management, and its use is restricted to general institutional communications and service channels rather than the marketing of specific financial products or services.

The Bank of Ghana has launched a Cyber and Information Security Directive (CISD) for the financial industry, setting a mandatory framework for regulated financial institutions to establish and continuously improve cyber and information security controls across governance, risk management, cyber defence, and incident response. The CISD introduces a proportional, risk-profile-based implementation approach and sets explicit governance expectations, including board accountability for cyber and information security strategy, oversight and budgeting, and senior management responsibilities for establishing a Cyber and Information Security Risk Management Committee. Regulated financial institutions must establish a dedicated Information Security Department with protected funding that is separate from the general information technology budget, and appoint a Chief Information Security Officer (CISO) subject to the Bank of Ghana’s prior written approval, with the CISO positioned in senior management and reporting directly to the chief executive with access to the board. Operational requirements include baseline standards and controls such as ISO/IEC 27001 certification and adoption of ISO/IEC 27032, PCI-DSS certification where card data is handled, and alignment of incident handling methodologies with international standards such as National Institute of Standards and Technology and International Organisation for Standardisation. Moreover, the CISD mandates multi-factor authentication, privileged access management controls, periodic access reviews, structured testing and exercise requirements, and formalised third-party and outsourcing controls including managed security service provider conditions tied to approvals and accreditation. It also introduces obligations on incident reporting to the Bank of Ghana through monthly returns by the 15th of each month, alongside immediate notification thresholds for significant incidents. It also includes additional governance and security requirements for cloud adoption, digital innovations, as well as artificial intelligence and machine learning systems.

The Saudi Central Bank (SAMA) has issued an updated Oversight Framework of the Payment Systems and their Operators, replacing its existing oversight framework for payments and financial settlement systems. The framework sets out SAMA’s approach to regulating, supervising and monitoring payment systems and their operators, aligning scope and expectations with the Law of Payments and Payment Services and its implementing regulations. The updated framework defines the perimeter of oversight, including the national payment system owned or operated by the central bank, payment systems operated in the Kingdom of Saudi Arabia including cross-border arrangements, and other systems that require cooperative oversight with relevant authorities. It applies to both critical payment systems classified as systemically important and non-systemically important systems, and describes a principles-based methodology grounded in applicable regulatory requirements and the Principles for Financial Market Infrastructures issued by the Committee on Payments and Market Infrastructures and the International Organization of Securities Commissions. Ongoing supervision is structured around continuous monitoring, periodic assessments, and rulemaking or corrective changes through policies, rules and instructions. Significant payment system operators are required to conduct a self-assessment at least annually, on material changes, or when requested by SAMA, while unclassified operators must self-assess periodically as agreed under their licence or as determined by SAMA. Critical payment system operators must publicly disclose a self-assessment summary after obtaining SAMA’s no-objection letter, in line with the disclosure framework developed by the Committee on Payments and Market Infrastructures and the International Organization of Securities Commissions, and SAMA may require an independent third-party assessment where necessary.

The United States Financial Stability Oversight Council has issued proposed interpretive guidance for public comment that would replace its current guidance on nonbank financial company determinations and withdraw its existing analytic framework for financial stability risks. The proposal would reorient the designation regime toward an activities-based approach as the default tool for addressing financial stability risks, with entity-specific designations used only where risks cannot be adequately addressed through regulators’ actions on activities and practices. The proposed guidance would embed consideration of economic growth and economic security in the Council’s analysis, update the analytic methodologies and vulnerability set, and merge designation procedures and financial stability analytics into a single document. It would also commit the Council to conduct a cost-benefit analysis before any designation decision, including assessing the likelihood of a company’s material financial distress as part of evaluating expected benefits and costs. Procedural changes include a new pre-designation off ramp under which the Council would identify remediation steps for a company or regulators and generally expects material risks to be addressed within 180 days, alongside a mechanism to notify a relevant financial regulatory agency of a potential risk and request a written response on proposed actions and timelines. The proposal would also raise the threshold for interpreting a “threat to the financial stability of the United States” for designation purposes to situations that could impair financial intermediation or market functioning enough to inflict severe damage on the broader US economy.

A new FEDS Note examines whether higher AI adoption is associated with weaker hiring demand and finds no evidence so far that firms or industries using more AI are posting fewer jobs. Using online vacancy data and business survey responses, the note concludes that the broader slowdown in U.S. job postings after the pandemic recovery does not appear to be driven by AI. The analysis combines Lightcast job-posting data with the U.S. Census Bureau's Business Trends and Outlook Survey and tests both industry-level AI adoption and a narrower firm-level proxy based on prior postings requiring AI or machine learning skills. Across models using one, three, six and 12 month lags over September 2023 to November 2025, coefficients were generally positive or close to zero, with no evidence of a negative effect on total postings. The note adds that any observed positive relationship is unlikely to be causal, that effects could still differ across specific occupations, and that the exercise is intended as ongoing monitoring rather than a conclusion about future labor market effects.

The U.S. Securities and Exchange Commission approved an amendment to the National Market System Plan governing the Consolidated Audit Trail and granted exemptive relief from certain requirements of Rule 17a-1 under the Securities Exchange Act of 1934 to enable cost-saving measures intended to reduce CAT operating costs while maintaining core regulatory functionality. The Commission estimates the changes will deliver approximately USD 50 million to USD 70 million in annual savings compared with the 2025 CAT budget. The amendment expands on cost-savings measures approved in 2025 and permits the Plan Participants to cease creating interim lifecycle linkages unless requested by an authorized regulatory user, delete certain CAT data including all data older than three years, and ease requirements related to re-processing late records. It also allows Plan Participants to cease certain functionality associated with the online targeted query tool, stop reporting rejected messages received by Plan Participants, relax certain CAT data processing deadlines, implement a revised approach for generating anonymized customer identifiers, and adopt a spending cap provision governing future CAT changes.