Global Regulator & Central Bank News Roundup

The Australian Prudential Regulation Authority has finalised a simpler and more flexible pathway for authorised deposit-taking institutions to gain accreditation to use the internal ratings-based approach for calculating credit risk-weighted assets. The changes address the limited uptake of the IRB approach beyond Australia’s largest banks by making APRA’s expectations more transparent and allowing medium-sized institutions to progress toward accreditation in phases, rather than meeting all requirements upfront. The new pathway gives applicants three years to meet the required standards gradually while realising capital benefits at each phase. Following consultation feedback, APRA will allow the capital charge for interest rate risk in the banking book to be phased in on a proportional basis and has clarified expectations on permanent partial use, operational risk management, model validation and governance, phased roll-out sequencing and supervision of new IRB institutions. APRA also confirmed that, after the phase-out of Additional Tier 1 capital instruments, it will take into account the 25 basis point increase in the additional Common Equity Tier 1 capital requirement when calibrating Pillar 2 adjustments for medium-sized institutions accredited after 1 January 2027. The revised Prudential Standard APS 113 Capital Adequacy: Internal Ratings-based Approach to Credit Risk and Prudential Practice Guide APG 113 Capital Adequacy: Internal Ratings-based Approach to Credit Risk take effect on 30 June 2026.

The Monetary Authority of Macao has officially activated mBridge in Macao, enabling cross-border transactions on the multilateral central bank digital currency platform after joining it earlier this year. On the first day of live operation, three of the 11 initially approved participating banks completed 23 cross-border transactions covering trade settlement and international remittances. Bank of China (Macau), S.A. Macau Branch, Industrial and Commercial Bank of China (Macau), S.A. and Bank of Communications Co., Ltd. Macau Branch carried out the initial transactions. These involved mainland China, Hong Kong and the United Arab Emirates, with a total value equivalent to nearly MOP13 billion. The authority said the system operated stably on day one, while the other eight participating banks are continuing preparations and are expected to complete implementation of their operations in the near future. mBridge is based on central bank digital currencies and distributed ledger technology and supports real-time peer-to-peer clearing and settlement between participating commercial banks. The Monetary Authority of Macao said it will next explore linking the digital pataca infrastructure with central bank digital currencies in other countries and regions, or with other international financial infrastructures. It said this is intended to broaden international cooperation links and strengthen the financial services platform between China and Portuguese-speaking countries.

The Hong Kong Monetary Authority has set up a Tokenised Bond Expert Group to support broader use of tokenised bonds in Hong Kong. The group brings together industry associations, financial institutions, legal advisory firms, and financial infrastructure and technology providers to examine policy measures, market practices, and innovation, building on the HKMA’s existing tokenised bond initiatives. The first round of discussions took place in May and focused on Hong Kong’s legal and regulatory regime and how it applies to tokenised bond issuance and transactions. Feedback from those discussions is informing the HKMA’s ongoing work with the Financial Services and the Treasury Bureau to review and identify possible enhancements to the legal and regulatory framework to facilitate wider use of tokenisation in the fixed income market. The HKMA will continue topic-specific discussions with Expert Group members, review the group’s composition as needed, and announce details of the legal and regulatory exercise separately.

The Central Bank of the Philippines has issued a memorandum clarifying regulatory expectations for virtual asset service providers (VASPs) conducting due diligence on coins and tokens offered to customers. The guidance builds on Section 161-M of the Manual of Regulations for Non-bank Financial Institutions, which requires VASPs to maintain robust due diligence and accreditation processes for virtual assets listed or traded on their platforms. VASPs may develop their own listing frameworks, but these must consider the guidance and support safe, sound and consumer-centric virtual asset services. The listing review is structured around six pillars covering issuer background, market capitalization and maturity, use cases, transparency, traceability and security, redemption, liquidity and reserves, and legal and compliance matters. The guidance points to issuer governance, financial information, market indicators, token utility, technical security, reserve arrangements and regulatory status as relevant assessment areas. VASPs must also monitor listing criteria on an ongoing basis, set deviation thresholds that trigger delisting, and suspend or delist assets where customer protection concerns arise, including liquidity or capitalization breaches, issuer insolvency, regulatory non-compliance, cybersecurity issues, misleading disclosures, market abuse or abnormal market or price movements. Anonymity-enhancing virtual assets, also referred to as privacy virtual assets, are prohibited from being listed or supported.

The Eurosystem is inviting financial market stakeholders and public sector bodies to express interest in joining the Appia contact group, which will act as a forum for market input on its Pontes and Appia projects for tokenised wholesale financial markets. The group will provide feedback on the operation and evolution of Pontes, the DLT-based settlement solution linking market DLT platforms with TARGET Services, and contribute to the Appia blueprint for a European tokenised financial ecosystem. The group will discuss business and technical matters for the Pontes Pilot, including user requirements, system functionality, testing, migration, operations and risk. Its Appia-related work will cover developments in distributed ledger technology, standardisation and roadmap topics including confidentiality, privacy, cross-chain interoperability and synchronisation, collateral mobilisation, secondary-market structure and cross-border issuance flows. Members will be selected based on institutional engagement and expertise, with the Market Infrastructure Board and Market Infrastructure and Payments Committee deciding the group’s composition. Applications from interested financial market stakeholders are due by 19 June 2026. The group will be chaired by the European Central Bank and is expected to meet quarterly.

The European Supervisory Authorities published their first annual overview of major ICT-related incidents in the EU financial sector under the Digital Operational Resilience Act, covering 3,383 major incidents reported for 2025. The findings show that ICT risk is increasingly cross-border and interconnected, but that most reported incidents did not translate into material disruption for clients, transactions or financial counterparties. More than 60% of incidents occurred in the credit sector and 16% in the payments sector, reflecting market structure, pre-existing incident reporting obligations and the scale of digital, customer-facing services, rather than evidence of sector-specific weakness. The incident profile points mainly to operational and third-party dependencies. Around one third of incidents had a cross-border impact, and about 8% affected more than 10 countries, highlighting the role of shared infrastructures, common ICT services and cross-border business models. System failures accounted for 51% of major incidents, external events for 27%, payment-related incidents for 18% and cybersecurity-related incidents for 10%. Root-cause reporting showed system failures or malfunctions in about half of incidents, external events in 32%, process failures in 19% and human error in 12%. Almost one third originated from third-party failures, including ICT third-party service providers, other financial entities and infrastructure providers. Within cybersecurity incidents, distributed denial-of-service attacks represented 33%, while data exfiltration and manipulation, including identity theft, represented 31%. The impact data suggests that incident response and containment measures often limited spillovers. Almost 60% of incidents either did not affect clients or affected fewer than 1,000 clients, while 32% did not affect transactions and 26% affected fewer than 1,000 transactions. Only around 1% affected more than one million transactions, mainly in the credit and payments sectors, and fewer than 18% affected financial counterparts. The report also identifies divergent reporting practices and data-quality constraints in the first year of DORA reporting. However, a new IT tool for competent authority reporting to the ESAs, automated validation checks and the DORA Register of Information are expected to improve data quality and support analysis of systemic ICT risk concentrations.

The Authority for Anti-Money Laundering and Countering the Financing of Terrorism (AMLA) has launched a consultation on draft guidelines specifying how obliged entities should conduct ongoing monitoring of business relationships under Article 26(5) of Regulation (EU) 2024/1624. The draft guidelines apply across financial and non-financial sectors and set out a proportionate, risk-based framework for keeping customer information up to date and monitoring transactions, activities, behaviours and events that may indicate money laundering or terrorist financing risks, including risks linked to the non-implementation or evasion of targeted financial sanctions where these arise in a business relationship. The framework would require obliged entities to treat ongoing monitoring as part of customer due diligence rather than as a standalone transaction-control exercise. Customer information would need to remain accurate through periodic reviews calibrated to risk and event-driven reviews when changes in the relationship, customer profile or external information point to a possible shift in risk. The draft also takes a risk-based approach to expired identity documents: obliged entities would not need to re-collect them automatically, but would have to assess whether an updated document is necessary to maintain reliable customer information. For transaction and activity monitoring, the draft expects obliged entities to build frameworks that reflect their business-wide risk assessment, customer knowledge and access to relevant data. Monitoring may be manual, automated or semi-automated, and may operate before, during or after a transaction or activity depending on the business model. The focus is on detecting unusual or suspicious behaviour in context, including patterns that emerge over time or across products, channels or counterparties. Monitoring outputs should feed back into customer due diligence, risk classification and escalation processes, supported by documentation, testing, data-quality controls, staff training and governance for advanced analytical tools, including artificial intelligence.

The European Banking Authority (EBA) has signed a Memorandum of Understanding with the New York State Department of Financial Services under the Markets in Crypto-Assets Regulation to strengthen supervision of cross-border stablecoin activities. The arrangement covers stablecoins issued in the European Union and New York State, including entities directly supervised by the EBA under MiCA. Under MiCA, the EBA has direct supervisory responsibility for issuers of significant asset-referenced tokens and electronic money tokens. The framework sets principles and procedures for information exchange and supervisory coordination, including mutual assistance in ongoing supervision and in crisis or emergency situations. It covers information on authorisations, reserve assets, governance, liquidity, stress testing, outsourcing, business model changes, sanctions and recovery, redemption or resolution planning, and provides for quarterly exchanges of specified data where available. It also allows participation in investigations and on-site inspections, requires notification of material infringements and major ICT-related security incidents, and enables the sharing of confidential information because the EBA has assessed the NYDFS confidentiality and professional secrecy regime as equivalent to MiCA standards.

The European Commission has adopted a delegated act introducing targeted, temporary adjustments to the EU implementation of the Fundamental Review of the Trading Book, the Basel III market risk capital framework for banks. The measures are designed to preserve the international level playing field for EU banks active in global capital markets as some major jurisdictions are expected to delay FRTB implementation beyond 1 January 2027. They include a multiplier allowing adversely affected banks to scale down FRTB capital requirements to the level of their pre-FRTB capital requirements, after applying the targeted amendments and the output floor. The amendments cover both the internal model and standardised approaches. They temporarily relax aspects of the profit and loss attribution test and the risk factor eligibility test, introduce more flexible treatment for Collective Investment Undertaking exposures, and provide specific flexibilities for default risk capital requirements for sovereign exposures under the internal model approach and hedged equity exposures under the standardised approach. Banks using the multiplier must also comply with specified market risk reporting and disclosure requirements, calibrate the multiplier consistently with capital neutrality, and use the pre-FRTB trading book and non-trading book boundary requirements during the three-year period. The delegated act is subject to scrutiny by the European Parliament and the Council. If no objection is raised, the measures will apply from 1 January 2027 through the end of 2029.

The European Commission has published the Gas Market Task Force report on EU gas and gas derivatives markets, concluding that both markets are functioning well while identifying further work to strengthen monitoring, enforcement and supervisory cooperation. The report finds low concentration in EU upstream and downstream wholesale gas supply markets, no concerns from concentration in Title Transfer Facility derivatives positions, and broadly fit-for-purpose commodity derivatives rules based on stakeholder feedback. The report points to targeted improvements rather than broad new regulation. These include closer monitoring of gas supply chains and algorithmic trading, new data-screening tools using REMIT data - transactional and other wholesale energy market information reported to the Agency for the Cooperation of Energy Regulators - timely compliance with the revised REMIT Implementing Regulation, stronger Member State implementation of REMIT, and adequate resources for national regulatory authorities. It also identifies scope to improve MiFID position reporting, give trading venues access to a broader set of over-the-counter derivatives data for position management controls, clarify position limit reporting for third-country venue activity, streamline hedging and liquidity provision exemptions, and introduce a one-off notification for entities using the ancillary activity exemption. The report also calls for Member States to minimise the impact of storage obligations on derivatives markets and for ACER and ESMA to improve data use and supervisory cooperation, including through a dedicated data workstream and possible joint guidance or more institutionalised cooperation.

The House of Lords Financial Services Regulation Committee published a report on the growth and proposed regulation of stablecoins in the UK, warning that uncertainty over the final regulatory regime has suppressed the development of GBP stablecoins and could leave the UK behind the United States and European Union. The Committee argues that regulation should not seek to decide which stablecoin use cases will succeed, but should provide a clear, flexible framework that allows stablecoins to compete with other forms of payment and support emerging uses such as cross-border payments, programmable payments and tokenised asset settlement, while addressing risks to financial stability, consumer protection and financial crime. The report supports core safeguards in the Financial Conduct Authority and Bank of England proposals, including 1:1 backing, statutory trust arrangements for backing assets, audited disclosures and the Bank’s proposed backstop lending facility for systemic issuers. It recommends further work on the calibration of several key measures, including the Bank’s proposed requirement for systemic stablecoin issuers to hold at least 40% of backing assets in unremunerated central bank deposits, temporary holding limits of GBP 20,000 for individuals and GBP 10 million for businesses, redemption requirements, issuance-linked capital requirements, and restrictions on deposit-takers issuing stablecoins. The Committee says these measures risk weakening issuer viability, limiting competition or creating operational burdens unless supported by clearer analysis and adjusted as the market develops. The Committee further calls for clearer anti-money laundering and know-your-customer responsibilities across issuers, exchanges and custodians, including the legal basis for freezing stablecoins or blocking transactions, and recommends that HM Treasury consider whether existing rules are sufficient for private unhosted and unregulated wallets. Finally, it also urges for clearer regulatory ownership across HM Treasury, the FCA and the Bank, demanding clarification how stablecoins will enter the payments regulatory perimeter, how systemic designation will be determined, how firms will move from FCA-only to dual regulation, and whether stablecoin-specific insolvency legislation is needed.

The UK Financial Conduct Authority has proposed replacing product-level Task Force on Climate-related Financial Disclosures reporting for investment products with a simpler, more targeted regime that distinguishes between retail and institutional investor needs. The product-level TCFD reports would be removed, while the overall product scope would remain broadly unchanged. Entity-level TCFD reporting is not included in the proposals, although the FCA will continue to consider whether those rules can also be streamlined. For retail clients, firms would need to periodically consider whether climate risks or opportunities could be materially relevant to a product’s financial performance or returns. Where they are material, firms would disclose them in retail communications that provide general information on risk and financial returns, including through the product summary where the product is also in scope of the Consumer Composite Investment regime. The FCA does not expect climate information to be disclosed for every product, and firms may use their usual risk assessment processes rather than create new systems. For institutional clients, firms would have to provide, on request, at least scope 1, 2 and 3 greenhouse gas emissions data to clients that need the information for their own climate disclosure obligations. Eligible clients could request the information once per calendar year per product. Guidance would encourage firms to provide other metrics where reasonably required, feasible and supported by contractual arrangements, while avoiding disclosures where data gaps or methodological limitations would make the information misleading. The FCA estimates the changes would produce ongoing industry savings of approximately GBP 20 million per year.

De Nederlandsche Bank has published sector-wide observations from an exploratory review of how seven banks, payment institutions and electronic money institutions manage external payment fraud. The review found that institutions devote clear operational attention to fraud prevention and customer protection, but that their approaches could be strengthened through more targeted risk appetite setting, better substantiation of key risk indicators and stronger risk-based steering of detection and alert-handling capacity. The review focused on non-bank fraud, where victims authorize payments under false pretenses, because these cases are widespread and are generally not subject to mandatory compensation. DNB found that fraud controls are often driven by operational teams focused on signal processing, triage and follow-up, while strategic choices on prioritization, investment and capacity deployment are less developed. Some institutions have key risk indicators, but these are not always well substantiated or used to steer decisions. DNB also observed that institutions use different combinations of business rules, machine learning and model architectures, but some give limited attention to periodically testing alternative or complementary detection methods. In some cases, detection systems are constrained by the capacity available to handle alerts, which can affect the ability to identify potentially fraudulent transactions. The findings also point to differences in how institutions balance customer instructions against fraud prevention. Several banks refuse potentially fraudulent transactions even where the customer insists on proceeding, while others take different approaches. Customer warnings, push notifications and public campaigns are widely used, but institutions often find it difficult to measure their effectiveness.

The Dutch Authority for the Financial Markets has published findings from a thematic review of how financial firms identify, assess and monitor politically exposed persons (PEPs) under the Anti-Money Laundering and Anti-Terrorist Financing Act. The review found that firms do not always apply tailored due diligence to PEPs, even though each PEP must be assessed on the basis of their specific risk profile and PEP status does not automatically imply a high risk of money laundering or terrorist financing. The review covered three investment institutions, two investment firms and nine financial service providers that mediate in life insurance or operate under the national regime. The main findings concern four areas. First, firms should assess PEP risks using relevant indicators, such as country corruption risk, and should not use nationality as a standalone risk criterion because this may create a risk of unjustified discrimination. Second, firms need a consistent legal understanding of the PEP definition, including domestic PEPs, family members and close associates, and should ensure that policies, screening lists and actual procedures are aligned. Third, firms that use external providers or tooling for PEP identification and monitoring must define their role, sources and methods clearly, while retaining responsibility for the quality and reliability of outcomes. Tooling may not always detect PEP status changes fully or promptly, including after political changes such as elections. The AFM also found weaknesses in training and recordkeeping. Some firms referred to the Wft advisory diploma as training on the PEP concept, but this may not be sufficient for staff responsible for identifying, assessing and monitoring PEPs under the Wwft. In some cases, firms did not record PEP identification, verification, client due diligence and screening results in a sufficiently traceable way, making it unclear which additional measures had been taken and which data or documents had been used.

The Swiss Financial Market Supervisory Authority (FINMA) has supplemented its earlier guidance on money laundering risk analysis for banks and FinIA institutions after reviewing analyses from more than 30 banks inspected in spring 2023, as well as numerous other banks and FinIA institutions. FINMA found progress in how banks define risk tolerance and structure their analyses, but concluded that further improvements are needed for risk analysis to operate as an effective central tool for managing anti-money laundering risks. The main weaknesses relate to the practical design and use of risk tolerance, risk monitoring and residual risk assessment. FINMA identified insufficient deliberate exclusions from business models, overly permissive or poorly monitored exception-to-policy processes, and key risk indicators that do not give management a clear view of exposure. It also found that some analyses omit relevant client, domicile, product or service risks, use insufficient granularity for higher-risk business models, or fail to distinguish properly between inherent risk, control risk and net risk. Institutions are expected to use meaningful quantitative measures, compare net risk with risk tolerance at both individual and aggregate levels, and assess whether anti-money laundering resources remain adequate.

The Malta Financial Services Authority has issued a supervisory letter to licence holders setting out expectations for the governance, risk management and oversight of artificial intelligence. The letter frames AI as a prudentially relevant risk area and expects firms to assess how current and anticipated AI use affects their risk profile, decision-making, resilience, consumer outcomes, financial stability and market integrity. The authority’s observations from a 2025 cross-sectoral assessment indicate that AI adoption in Malta’s financial sector remains limited, but that many firms lack formal or board-approved AI strategies, rely heavily on external tools, particularly generative AI solutions, and have limited internal expertise and governance structures. The MFSA expects boards and senior management to retain accountability for AI use, including third-party systems, and to strengthen controls over model risk, data governance, outsourcing, concentration risk, operational resilience, customer-facing use cases and financial crime applications. Licence holders are expected to complete a structured self-assessment covering AI use cases, dependencies, governance, accountability, oversight and controls. They do not need to submit the assessment at this stage, but must be able to evidence that it has been performed, considered by the board and senior management, and followed by remediation where gaps are identified.

The Central Bank of Iceland has announced that consumers in Iceland will soon be able to make credit and debit card payments even when internet connections fail. Working with Icelandic card issuers and card acquirers, it has enabled offline payments of up to ISK 50,000 per payment card issued to a person of legal age in Iceland, to reduce disruption to domestic retail payments and allow continued purchases of essential goods. The offline option will apply only when the physical card is used, inserted into the payment terminal, and authenticated with a PIN. It is intended for necessities such as groceries, fuel, and medicine. Issuers may set higher limits for specific cards and may also allow offline payments for other goods. For existing cards, cardholders must activate offline functionality by making a chip-and-PIN purchase once so the chip stores the authorisation. Activation for existing cards should be possible from 1 July 2026, although full rollout may take time across service providers. Cards issued on or after 1 July 2026 will include offline payment authorisation automatically. Central Bank said it will continue work to strengthen payment resilience, including enabling contactless payments by smartphone and smartwatch during internet outages.

The Bermuda Monetary Authority (BMA) has published a discussion paper on potential new banking models for Bermuda, marking an initial step toward updating the banking and deposit-taking framework. The review is intended to inform future licensing and authorisation proposals, with the Authority seeking models that could diversify the banking sector, improve access to banking services, support innovation and preserve alignment with Basel standards and anti-money laundering and anti-terrorist financing requirements. The paper considers wholesale models such as depositary and custodian banks, merchant and investment banks, brokerages and broker-dealers, digital asset banks, and international agent or representative banks. It also examines domestic retail and commercial models, including mutual societies, mortgage corporations and finance companies, publicly owned savings banks, and development banks. The consultation asks whether these models would benefit Bermuda, attract new business, create disruption or introduce risks. It also seeks views on demand for new entrants, growth segments with unmet banking needs, factors that would support new products and emerging technologies, whether additional banking models should be considered, and which criteria the Authority should prioritise when selecting models for Bermuda. The Authority aims to follow with a consultation paper that reflects the feedback received and presents refined proposals for an updated banking and deposit-taking regime.

The U.S. Securities and Exchange Commission published its draft strategic plan for fiscal years 2026 to 2030 for public comment, setting out a return to its core statutory mission of protecting investors, maintaining fair, orderly, and efficient markets, and facilitating capital formation. The plan is structured around three goals: renewing regulatory policy to support innovation, capital formation, market efficiency, and investor protection; shifting regulatory practices toward greater stakeholder engagement, compliance support, and enforcement focused on established law; and improving operational efficiency through organizational, technology, and performance management reforms. The policy agenda includes providing a clearer regulatory foundation for digital assets and distributed ledger technologies, including securities law boundaries, tokenized offerings, custody, trading, staking, and coordination with the Commodity Futures Trading Commission. It also includes expanding capital-raising pathways for entrepreneurs and smaller issuers, modernizing disclosure and shelf registration processes, reviewing legacy rules, and grounding rulemaking in cost-benefit analysis. The enforcement and supervisory agenda emphasizes fraud, deception, and market manipulation, retrospective reviews of existing rules, and an evaluation of the SEC’s administrative law framework. Operational priorities include a targeted reorganization to reduce duplication and improve collaboration, a review and modernization of technology systems including EDGAR, expanded responsible use of artificial intelligence, and reforms to performance management and internal reporting. The SEC requested public comment on the draft plan.

The Federal Reserve Board has published a product overview of the broader U.S. buy now, pay later credit market, estimating that major providers originated USD 156.7 billion in consumer credit products in 2025. The analysis extends beyond the commonly studied “pay in 4” model to include other short-term and longer-term installment loans, with “pay in 4” plans accounting for USD 78.3 billion, or about half of total issuance. The estimates cover Affirm, Afterpay/Block, Klarna, PayPal, Sezzle and Zip, using publicly disclosed firm information from 2019 through 2025. More than 60% of total issuance carried 0% annual percentage rate, while APR-bearing products accounted for 37%. “Pay in 4” volumes increased nearly 80% from the Consumer Financial Protection Bureau’s most recent 2023 estimate, while other short- and longer-term installment products expanded at comparable rates. Afterpay/Block and PayPal represented 70% of “pay in 4” issuance, while Afterpay/Block and Affirm together accounted for 60% of total BNPL credit issuance.