Global Regulator & Central Bank News Roundup

The Council of Financial Regulators' quarterly statement said Australia's financial system has remained resilient, with banks holding strong capital and liquidity positions and lending standards remaining prudent, but judged that financial stability risks still require close monitoring. The Council backed the Australian Prudential Regulation Authority's decision to leave macroprudential settings unchanged after its May review, while stressing that heightened geopolitical uncertainty and a more complex operational risk environment are keeping global risks elevated. A central focus of the meeting was preparedness for geopolitical disruption and the impact of frontier artificial intelligence on cyber risk. The Council said direct Australian financial system exposures to the Middle East are limited, but recent developments reinforce the need for stronger contingency planning, including back-up payments arrangements, security controls and communication protocols. It also said frontier AI models have intensified cyber risk in an already elevated threat environment, and discussed with the Department of Home Affairs and the Australian Signals Directorate how regulators and security agencies can strengthen incident-response coordination, manage third-party risk and encourage faster patching, reduced attack surfaces and stronger baseline cyber practices across financial institutions. Separately, the Council discussed the progress of Australia's 2026 Financial Sector Assessment Program with the International Monetary Fund, with the final Financial System Stability Assessment due later this year. It also reviewed implementation of actions from the review into small and medium-sized banks, considered Treasury's completed consultation on a cash distribution regulatory framework, and noted ongoing cross-agency work under the Better Regulation Roadmap, including an implementation plan to streamline data collection and sharing.

The Central Bank of the Philippines has issued a guidance paper setting out governance principles for the use of artificial intelligence in financial services. The paper recommends that BSP-supervised and registered financial institutions develop their own AI governance frameworks, proportionate to the nature, scale, complexity and materiality of their AI systems, as well as their operational complexity and risk profile. The principles, which are non-binding and compliance is voluntary, are intended to guide AI governance policies and risk management frameworks across the AI system lifecycle. The guidance is built around the STARS principles of sustainability, transparency, accountability, responsibility and security. Under sustainability, AI systems should be materially beneficial, aligned with broader financial sector sustainability efforts, and developed with environmental and social considerations, including energy efficiency, workforce development and responsible use. Under transparency, institutions should maintain centralized AI inventories, disclose where AI outputs are used in products or processes, preserve documentation and auditability, define mitigation procedures for identified risks, and require equivalent transparency from outsourced service providers. Under accountability, roles should be clearly assigned across management, developers and other stakeholders, supported by human oversight, segregation of duties, competent leadership, and escalation and remediation mechanisms across the AI lifecycle. Under responsibility, institutions should use well-prepared and representative data, guard against unfair or discriminatory outcomes, protect personal data rights, and provide clear opt-in and opt-out mechanisms where applicable. Under security, institutions should apply rigorous cybersecurity and data quality controls, including safeguards against AI-specific threats such as adversarial attacks and data poisoning. The paper maps these principles to controls across the AI system lifecycle, covering planning, development, validation, deployment and monitoring. Recommended controls include risk-based assessment of use cases, independent validation, pre-deployment and production testing, documentation, business continuity planning for AI-related disruptions, and processes for regression or resolution where AI systems do not operate as expected.

The Reserve Bank of India has opened a consultation on draft guidance that would move its model risk expectations beyond credit risk and establish a broader framework for all models used by regulated entities. The draft would apply across a wide range of RBI-regulated firms, including banks, co-operative banks, all-India financial institutions, non-banking financial companies, asset reconstruction companies and credit information companies. It covers internally developed models, third-party models and models using artificial intelligence or machine learning. The proposed guidance would require each regulated entity to adopt a board-approved Model Risk Management Framework covering governance, risk tiering, inventory, documentation, validation, approval, deployment, monitoring, change management, business continuity and decommissioning. Entities would remain accountable for model outcomes regardless of whether a model is built internally or sourced externally. High-risk models would require approval by the Risk Management Committee of the Board, while all models, including third-party models, would need independent validation, ongoing monitoring and appropriate documentation. Decommissioned models would need to remain in inventory for at least 10 years from decommissioning or from the date they stop serving as a backup or benchmark reference, whichever is later. The draft sets additional expectations for third-party and AI or machine learning models. Third-party models would be subject to due diligence, contractual access to technical documentation, audit rights, continuity arrangements and enhanced board committee oversight. For AI and machine learning models, the draft would require regulated entities to assess whether risks can be identified, measured, monitored and managed before deployment, with stronger controls where models affect customers, operations or financial outcomes. It would also require explainability thresholds, safeguards against hallucinations, bias and discriminatory outcomes, and testing under atypical, stressed or adversarial conditions. Customer-facing models would need cyber controls, user disclosures and access to human assistance, while automated decision-making would need human oversight, override or suspension mechanisms, and periodic review of decisions produced by models.

The Monetary Authority of Singapore has announced that it will establish a Future of Finance Institute to accelerate the adoption of new financial technologies and move the sector from experimentation to broader deployment. The institute will initially focus on artificial intelligence and tokenisation, bringing together MAS' existing public-private initiatives under a single coordinating body. While MAS will continue to set policy and regulatory frameworks, the new institute will work directly with industry to lower adoption barriers, connect financial firms with technology partners and shared expertise, and support institutions of different sizes. The institute will provide four core capabilities. A Knowledge Hub will offer validated use cases, deployment playbooks, solution providers and a capability roadmap. An Innovation Garage will coordinate industry collaboration on targeted AI and tokenisation projects. Industry Sandboxes will support controlled testing and pre-deployment validation for areas including programmable money, tokenised assets and AI-enabled workflows. Implementation Toolkits will include a Programmable Compliance Toolkit for tokenised assets and an updated AI Risk Management Toolkit with guidance for deploying agentic AI with safeguards. The institute builds on MAS-backed efforts including MindForge, PathFin.ai, Project Guardian and Project Orchid, and will be governed by a board drawn from MAS, major financial institutions, technology firms and academia, alongside practitioners with industry and technology expertise. Further details on the institute's strategy and governance are due later this year.

The Australian Securities and Investments Commission has issued a new class no-action letter for digital asset businesses that supersedes its 29 October 2025 letter, extends the transition deadline to 30 September 2026 and broadens the pathways firms may use while moving into the licensing regime. Subject to conditions, the position covers certain digital asset businesses providing financial services in relation to digital assets that are financial products, operating financial markets, or operating clearing and settlement facilities where one or more digital assets is a financial product. For Australian financial services licensing, firms may rely on the position where, by 30 September 2026, they have lodged an application for a new or varied licence, been appointed as an authorised representative, entered specified related-body-corporate arrangements, or entered an intermediary authorisation with an Australian financial services licensee. For Australian market licence and clearing and settlement facility licence requirements, businesses must notify ASIC and attend a licensing pre-meeting by 30 September 2026, then lodge the relevant application within 12 months of notification. The no-action position also provides a wind-down route for firms that notify ASIC by 30 September 2026 and cease the relevant activity by the specified date, which must be no later than 30 September 2026 and no later than three months after the notice. The position excludes crypto lending and earn products, most non-cash payment facilities other than stablecoins, and derivatives in relation to digital assets other than wrapped tokens. Businesses must have first provided the relevant service or operated the relevant market or facility in Australia on or before 31 December 2025.

The Thailand Securities and Exchange Commission has launched a public consultation on a draft notification that would impose travel rule and related risk management requirements on digital asset business operators. The proposal would require firms to ensure information accompanies digital asset transfers so transactions can be examined for money laundering risk, in line with international standards and as part of wider efforts to curb the use of digital asset services in cybercrime. The measure is intended as interim guidance developed with the Anti-Money Laundering Office while that agency prepares separate rules under the Anti-Money Laundering Act. Under the draft, operators would need policies and procedures for risks tied to sending and receiving digital assets, including collecting information on customers and counterparties, verifying the status of counterparties' digital asset operators or service providers, and confirming ownership or control of self-hosted wallets where relevant. Transfer-related information would have to be retained for at least five years, with the first two years stored so supervisors can retrieve or examine it immediately. Ordering operators would need to transmit originator and beneficiary information with the transfer order, and where intermediaries are involved, verify those intermediaries and take additional prescribed steps so the transfer route can be monitored continuously and completely. Receiving operators would also need to apply prescribed controls, including collecting originator and beneficiary information for incoming transfers from an ordering operator or, where applicable, directly from a customer.

The Reserve Bank of Australia has opened a review of payments system regulation and issued an Issues Paper seeking evidence on which policy issues it should prioritise. The review follows December 2025 amendments to the Payment Systems (Regulation) Act 1998 that expanded the legislation’s coverage to additional payment systems and participants, giving the RBA scope to consider a broader range of entities and activities in assessing whether regulatory action may be warranted in the public interest. The review focuses on competition, efficiency and financial safety issues arising from structural change in payments. Priority areas include merchant choice across debit networks in mobile and online environments, integrated platforms and bundling of payment services, token portability, AI agents in e-commerce, mobile wallets, non-designated card networks, buy now, pay later services, account-to-account payments, cryptographic uplift and overseas card-not-present fraud. The RBA highlights several market developments, including mobile wallets accounting for around 45 per cent of card payments by number, account-to-account payments accounting for 6 per cent of consumer payments in 2025, and overseas card-not-present transactions representing half of fraud on Australian-issued cards in 2024 despite accounting for around 3 per cent of transaction value. Stakeholder evidence is due by 7 August 2026. The RBA intends to publish regulatory priorities by the end of 2026, begin consultation on prioritised issues by mid-2027 and announce conclusions on those issues in 2028.

The South Korea Financial Services Commission has launched a taskforce and held a kickoff meeting on capital market infrastructure reform, focusing on securities trading and settlement upgrades alongside wider digital adoption in the financial investment sector. In opening remarks, FSC Vice Chairman Kwon Dae-young said the work will be guided by four principles of trust, shareholder protection, innovation and market access, with particular attention to how artificial intelligence and blockchain could reshape market infrastructure. The initial agenda combines market structure changes with digital transformation and risk controls. Authorities aim to prepare a roadmap for shortening the settlement period as early as October 2026. The Korea Exchange plans to extend trading hours by opening an after-market from September 14 and potentially a pre-market from the end of 2027. Separately, the Korea Securities Depository is working to establish by the end of 2026 a T+1 settlement infrastructure for over-the-counter transactions in unlisted securities and fractional investment products. The taskforce will also examine AI-based upgrades to market surveillance to strengthen detection of suspicious and unfair trading, while reviewing regulatory barriers to broader use of AI, including AI agents in personal asset management services. Alongside these measures, relevant institutions and industry IT functions are expected to coordinate on risk management, AI-related risks, cyber threats and investor protection. The government and related organizations will hold regular taskforce meetings to examine these measures and review areas where regulation may be hindering the use of AI by financial investment businesses.

The European Banking Authority published a consultation on a draft methodology for setting fines under the Markets in Crypto-Assets Regulation where it acts as supervisor of issuers of significant asset-referenced tokens and significant e-money tokens issued by electronic money institutions. The proposed approach is intended to make fines for negligent or intentional infringements consistent, proportionate and transparent, while keeping the final amount within MiCA’s statutory limits. The methodology would first set a basic amount as a percentage of the issuer’s annual turnover in the preceding business year, based on the severity of the infringement. Proposed starting points are 5%, 3% or 2%, depending on the infringement category. The amount would then be adjusted for aggravating factors, such as an infringement lasting more than six months, intentional conduct, previous infringements, financial crime or serious organisational weaknesses, and mitigating factors, such as reasonable preventive measures by senior management, prompt notification to the EBA or voluntary measures to prevent recurrence. The final fine could not exceed 12.5% of annual turnover for issuers of significant asset-referenced tokens or 10% for issuers of significant e-money tokens, unless twice the amount of profits gained or losses avoided can be determined as the applicable cap.

The European Banking Authority published final revised Guidelines on common procedures and methodologies for the supervisory review and evaluation process and supervisory stress testing, setting out a more risk-focused, proportionate and forward-looking framework for EU banking supervision. The revision consolidates SREP-related guidance, reduces the overall page count by 30%, and aligns the framework with the Capital Requirements Regulation III, Capital Requirements Directive VI, the Digital Operational Resilience Act and other regulatory developments. The revised Guidelines preserve the core SREP structure while introducing targeted changes to improve supervisory efficiency and consistency. They integrate ICT risk assessment into the operational risk assessment, add SREP guidance for third-country branches, clarify the interaction between Pillar 1 and Pillar 2 requirements including the output floor, merge liquidity and funding risk assessments, and incorporate environmental, social and governance factors and operational resilience across existing SREP elements. The framework also strengthens proportionality, expands the use of available supervisory information, introduces a flexible escalation framework for supervisory measures, and clarifies communication of SREP outcomes. The Guidelines will apply from 1 January 2027.

The European Central Bank is reviewing approximately 130 banking supervision publications to make its supervisory guidance clearer, more consistent and easier to use. The review covers guides, reports, letters and methodologies that set out supervisory expectations and good practices on a non-binding basis. Around 40 documents found to be outdated, superseded or no longer relevant have been discontinued, although they will remain available with clear labels for transparency and archival purposes. The review also clarifies how banks and other stakeholders should interpret the remaining guidance. The ECB has updated the classification of supervisory publications on its website to distinguish the purpose and use of different publication types and to reinforce that they do not create legal obligations or replace EU or national law. A limited set of documents has been, or will shortly be, revised to reflect specific regulatory developments, including clarification that the internal capital adequacy assessment process management buffer is a bank’s own view of capital needed to sustain its business model and is not a supervisory requirement. Other targeted changes include removing credit conversion factor expectations from the Guide to internal models and removing credit valuation adjustment references from two assessment guides. Several publications will undergo more substantial revision, with public consultations where changes are significant. Planned updates include replacing the Draft guide on governance and risk culture with a good-practices report in the first quarter of 2027, updating the Guide to licence applications in the third quarter of 2026, revising guidance on risk data aggregation and risk reporting in the fourth quarter of 2026, updating the Guide to on-site inspections and internal model investigations by end-2026, and finalising the review of leveraged transactions guidance by end-2026.

The European Insurance and Occupational Pensions Authority (EIOPA) published its June 2026 Financial Stability Report, concluding that the European insurance, reinsurance and occupational pension sectors remain resilient but face a risk landscape shaped by the interaction of geopolitical shocks, market repricing and structural change. Strong capitalisation, liquidity and funding positions helped the sectors absorb volatility linked to geopolitical developments, the repricing of financial risks and shifts in global trade arrangements. The central financial stability message is that no single vulnerability currently appears systemic, but several risks could reinforce one another under stress and create new channels for shock transmission across the financial system. Geopolitical tensions remain the main concern for supervisors, with risks transmitted through energy prices, trade disruption, defence-related fiscal pressures, inflation uncertainty, sovereign spreads and broader market volatility. Sovereign and credit risk repricing remain important transmission channels for insurers given their fixed-income portfolios, domestic sovereign exposures and links with banks and repo markets. Private credit and alternative assets remain limited in aggregate, with EEA insurers’ private credit exposure estimated at EUR 523 billion, or about 5% of total assets, but EIOPA highlights valuation uncertainty, illiquidity, complexity, concentration and bank interconnections as areas requiring continued monitoring. The insurance sector remained well-capitalised and liquid in 2025, supported by life and non-life premium growth, improved technical cash flows and higher investment returns. Key vulnerabilities include interest rate and foreign exchange volatility, claims inflation, lapses, market corrections and internationally exposed business lines such as marine, aviation, transport and trade credit. Reinsurers maintained strong solvency and profitability, but remain exposed to natural catastrophe losses, geopolitical disruption and cyber risks. Occupational pension funds remained stable, with improved funding positions and broadly stable assets, while longer-term risks stem from market volatility, interest rates, foreign exchange exposure, demographic pressures and the shift from defined benefit to defined contribution schemes. EIOPA also flags artificial intelligence and cyber risk as emerging stability issues because they may increase operational dependencies, third-party concentration and the speed and sophistication of cyber threats.

The Bank of England published a policy statement and draft Code of Practice for sterling-denominated systemic stablecoin issuers, setting out the main design of the UK regime for stablecoins that are widely used in payments and may pose financial stability risks. The revised framework would allow issuers to hold up to 70 percent of backing assets in short-term UK government debt, with the remaining 30 percent in unremunerated Bank of England deposits, replacing the earlier proposed 60 percent and 40 percent split. It would also replace proposed per-coin holding limits for individuals and businesses with a temporary GBP 40 billion issuance guardrail for each systemic stablecoin product. The draft rules keep the core safeguards of one-to-one backing, statutory trust arrangements for backing assets and reserves, direct legal claims for coinholders, and redemption at face value without undue constraint or cost. Redemption requests must be processed as soon as practicable and within 24 hours once a full request has been received, with the clock starting after anti-money laundering and know-your-customer checks are complete and the issuer has received the stablecoins. Issuers would be barred from paying interest or holding-period returns to coinholders, but could offer activity-based rewards linked to payments, and would be expected to seek direct access to payment systems to support redemptions and interoperability. The Bank intends to finalise the Code of Practice by the end of 2026, after which it can apply to recognised systemic stablecoin issuers. Further materials are expected in 2027, including guidance, updates to the Recognised Payment Systems Code of Practice, details on the Central Bank Liquidity Facility, and additional work on failure arrangements and disclosures.

The Malta Financial Services Authority published findings from a thematic review of terrorist financing, proliferation financing and targeted financial sanctions evasion risks across all MFSA-licensed credit institutions. The review found several sound practices, including alignment with Malta’s National Risk Assessment, regular targeted financial sanctions reporting to senior management and broad use of automated sanctions screening, but identified areas where institutions need stronger and more distinct treatment of proliferation financing and sanctions evasion risks. The review identified several areas where credit institutions’ frameworks require further strengthening. Proliferation financing controls were less consistently embedded than terrorist financing and targeted financial sanctions controls, including in risk assessments, board reporting and dedicated policies. The MFSA also pointed to uneven assurance over identity verification tools, transaction monitoring changes linked to instant payments, and the testing of sanctions screening systems. For institutions using or considering artificial intelligence, the authority expects stronger governance over system design, limitations, audit trails, human oversight and third-party technology providers.

The Central Bank of Ireland has launched a consultation on a draft Statement of Approach to Regulatory Impact Assessment and a proposed update to its public consultation approach. The proposals would formalize how the Bank identifies regulatory problems, evaluates policy options and assesses impacts, while clarifying when and how it consults stakeholders. They do not introduce new regulatory requirements or amend existing rules. The RIA framework would apply proportionately where the Bank exercises meaningful domestic discretion over regulatory interventions of general application, particularly new obligations or material changes with potentially significant effects. Analysis would vary according to impact, complexity, available discretion and evidence. Public consultation would generally be used for new regulatory requirements, significant changes to existing frameworks or cases where stakeholder input could materially inform policy design. Its scope may be reduced where the Bank has limited discretion in implementing binding external requirements, where changes are technical or clarificatory, or where timely intervention is required. Consultation periods would normally be 12 weeks and generally no shorter than eight weeks absent specific circumstances, with longer periods for significant or complex proposals. The framework also proposes clearer and more accessible materials, broader participation by consumers, civil society and other affected groups, and complementary engagement through workshops, surveys, webinars or targeted meetings.

The Central Bank of the Republic of Kosovo has launched a dashboard with gender-disaggregated data for the financial sector, aimed at improving transparency and supporting policymaking on financial inclusion, with a particular focus on women’s economic empowerment. It marks the first step in addressing gaps in gender-segmented financial statistics and, for the first time, allows key financing indicators to be monitored by gender. The dashboard tracks the number and value of loans, interest rates, nonperforming loans, collateralization levels and rejected loans. Reporting of these data began in July 2025 after the obligation was introduced through revisions to the Kosovo Credit Registry reporting manual approved in June 2025. The manual changes and the dashboard were developed under the WE Finance Code initiative, which in Kosovo is led by the central bank in cooperation with the European Bank for Reconstruction and Development and is being implemented in more than 30 countries.

The Central Bank of Uruguay is advancing implementation of its new cybersecurity supervision scheme for the financial industry, with the current phase focused on institutions in the National Payments System. From July 1, Electronic Money Issuing Institutions must begin periodic reporting on their cybersecurity capabilities, giving the central bank a more complete, consistent and comparable view of cybersecurity across the payments ecosystem. The scheme is based on the Uruguay Cybersecurity Framework developed by the Agency for Electronic Government and the Information and Knowledge Society. Institutions must use a maturity model to assess implementation of cybersecurity controls, generate an XML report, reference supporting evidence and submit the information through the IDI portal, while uploading evidence to the Filr repository. The platform validates XML structure, required fields, hierarchy, levels and summary metrics before the Central Bank of Uruguay reviews evidence and classifies controls as validated, observed or rejected. The reported information will support more proactive monitoring, continuous improvement of cybersecurity capabilities and identification of institutional and system-level strengthening opportunities. The Central Bank of Uruguay is also working to extend the scheme to other financial system actors.

The South African Reserve Bank has published a position paper setting out its Cash Smart Strategy and proposed regulatory architecture for South Africa’s physical currency ecosystem. The strategy treats cash as critical public infrastructure within a hybrid payments system and targets three outcomes: lower costs, equitable access across urban and rural areas, and secure and accountable cash handling. The paper estimates that consumers ultimately bear approximately ZAR 89.6 billion in annual direct and indirect cash costs. The proposed reforms include a national cash utility to consolidate wholesale infrastructure and cash-management systems, wider use of utility-coordinated white-label automated teller machines, and licensing of non-bank providers to support access. An activity-based, risk-proportionate licensing framework would cover significant cash services, supported by universal service obligations, common security and authentication standards, and an industry rulebook governing operations, reporting and data collection across banks, cash-in-transit providers, ATM operators and other material participants. Detailed regulations, licensing requirements, delegation arrangements, pricing methodologies and technical standards will be developed through subsequent formal consultations.

The Central Bank of the UAE has imposed a financial penalty of 20,000,000 on a branch of a foreign bank after examinations found significant and repeated failures in its Anti-money Laundering and Combating the Financing of Terrorism and Illegal Organisations and Sanctions framework. The action was taken under the Federal Decree Law Regarding the Central Bank and Organization of Financial Institutions and Activities. The Central Bank of the UAE also imposed an individual penalty of 300,000 on the branch's head of compliance and money laundering reporting officer for failing to fulfil the responsibilities of that role.

The Saudi Central Bank has launched an enhanced Regulatory Sandbox Service through its e-services portal, upgrading how firms and financial institutions apply to test innovative financial products and business models under its supervision. The service introduces fully integrated, automated processes and an advanced system for submitting and tracking applications, aiming to make onboarding more streamlined and flexible. The enhancement responds to rising demand to test new fintech concepts in Saudi Arabia’s financial secto and seeks to provide companies and financial institutions more efficient access to the Regulatory Sandbox.

Canada's Office of the Superintendent of Financial Institutions (OSFI) has launched a Streamlined Approvals Framework for targeted new entrants, establishing a quicker, clearer and more predictable route for eligible applicants to become federally regulated financial institutions. The framework is currently limited to provincial credit unions seeking to continue as federal credit unions, and entities with technologically innovative or emerging banking models, including fintechs or crypto-asset custodians, seeking to incorporate or continue as banks or federally regulated trust and loan companies. Entities outside this scope, including those seeking to establish insurance companies, insurance branches or foreign bank branches, remain subject to OSFI's existing guides and approvals processes. The process involves three phases. Phase 1 is an Initial Readiness Assessment, under which OSFI reviews pre-application information, meets the applicant and issues an initial readiness letter within four weeks of that meeting, setting out its preliminary view on whether the applicant is suitable for the streamlined framework. Phase 2 is the Formal Application Review for Letters Patent. OSFI will conduct a comprehensive but risk-based review calibrated to the applicant's readiness and risk profile, with a targeted completion period of 12 months after a complete application is acknowledged. Applicants must provide detailed information covering core regulatory requirements, including operational resilience, financial resilience, risk governance, and integrity and security risks. OSFI will also assess credible exit planning for an orderly wind-down of federally licensed operations, reflecting the heightened execution risk and more limited recovery options of new entrants. Where appropriate, OSFI may recommend restrictions or conditions, including undertakings, prudential agreements or business restrictions, before referring its recommendation to the Minister of Finance. Phase 3 is the post-ministerial approval Operational Readiness Review. After Letters Patent are issued, OSFI will assess whether key people, policies, processes and systems are in place before the Superintendent issues an Order to Commence and Carry on Business. The target for this phase is three months after ministerial approval, or alignment with the applicant's operational commencement plans. The new framework adds transparency through a voluntary applicant progress dashboard, which will track key milestones. OSFI emphasizes that regulatory requirements remain unchanged, application fees are unchanged and fees will not be refunded if timelines are not met.

The Department of Finance Canada pre-published proposed regulations to operationalize new Bank Act requirements on consumer-targeted fraud and advance implementation of the Consumer-Driven Banking Act. The fraud measures would require banks to obtain express consumer consent before enabling electronic funds transfer capabilities, including wire transfers, global money transfers and Interac e-Transfers, after informing consumers of their nature and potential uses. Banks would also need to allow consumers to disable those capabilities, process requests to change transaction limits within prescribed timelines, investigate suspicious transactions, notify consumers of suspicious requests and collect fraud data for reporting to the Financial Consumer Agency of Canada. The consumer-driven banking regulations would create a secure framework, overseen by the Bank of Canada, that allows individuals and businesses to share financial data with accredited service providers of their choice. The proposed rules would define the data covered by the framework and set requirements for accreditation, security, national security review, authentication and consent. The rules would also address participant and accredited third-party duties, liability, reporting and record keeping, technical standards, assessment fees and violations. The framework is intended to replace screen scraping with secure, API-based data sharing, with the Bank of Canada supervising participating entities, accredited third-party service providers, the technical standards body and the external complaints body, and maintaining a public registry to support transparency.

The U.S. Department of the Treasury announced the conclusion of its AI Innovation Series, a public-private initiative led by the Office of the Financial Stability Oversight Council and the AI Transformation Office to examine AI adoption in financial services. The series comprised four roundtables from March through May covering AI strategy and governance, value generation and efficiency, cybersecurity and risk management, and financial stability and economic security implications. Insights from the discussions will inform Treasury and Financial Stability Oversight Council work on regulatory policy, financial stability and barriers to innovation. At the fourth and final roundtable, which focused on financial stability and economic security, participants discussed AI’s implications for economic growth, labor markets, geopolitical competition, regional dependencies, and energy and hardware chokepoints. They said AI could raise productivity, support the creation of new ventures and jobs, and repatriate knowledge work to the United States, while noting that AI use had not yet had any material impact on the unemployment rate. Participants also called for clearer, harmonized, technology-neutral and principles-based regulatory expectations, including for AI and machine learning tools used in cybersecurity. Comptroller of the Currency Jonathan Gould discussed recent revisions to model risk management guidance and noted that its expectations are not intended to apply to generative and agentic AI. Participants also proposed cross-sector public-private partnerships on AI access for smaller institutions, AI awareness for boards and examiners, identity authentication to combat AI-enabled fraud, and liability issues linked to agentic commerce.

The Canadian Securities Administrators and the Canadian Investment Regulatory Organization announced a one-year delay to final market structure changes for U.S. inter-listed securities. Amendments to National Instrument 23-101 and its companion policy on trading fee caps, along with CIRO amendments to the Universal Market Integrity Rules on trading increments, were due to take effect on November 2, 2026 and will now take effect on November 1, 2027. The measures were designed to align Canadian trading fee caps and tick-size rules for securities listed on both a Canadian recognized exchange and a U.S. registered national securities exchange with corresponding U.S. Securities and Exchange Commission rules. The delay matches the SEC's revised timeline. The CSA said the pause will be implemented by each jurisdiction, including through blanket orders in Alberta and Ontario. In parallel, the CSA, in consultation with CIRO, will consider whether further action is needed in light of the SEC's proposal to rescind Rule 611, the order protection rule, and Rule 610(e) of Regulation National Market System.

The Commodity Futures Trading Commission has requested public comment on two developments in energy derivatives markets: extending standard futures contracts to 24/7 trading without changing fixed expiration, delivery or settlement terms, and listing perpetual contracts that reference physically delivered or storable energy commodities such as crude oil. The request focuses on whether these structures can support reliable, manipulation-resistant price formation and operate consistently with designated contract market core principles. The CFTC is seeking input on market liquidity and price reliability during overnight, weekend and holiday trading, particularly where energy cash markets are assessed during defined windows rather than traded continuously. It also asks how 24/7 trading would affect margin calls, collateral demands, clearing and settlement when traditional payment systems are unavailable, as well as the transmission of off-hours prices into benchmarks, exchange-traded funds, over-the-counter derivatives, commercial contracts and options markets. For perpetual energy contracts, the CFTC is seeking views on whether such products would meet identifiable hedging or risk-management needs, how they would establish a continuous reliable reference price, and how funding mechanisms would account for storage costs, convenience yield, seasonality and physical-market stress. The request also covers deliverable supply, storage constraints, the implications of negative crude oil prices, position limits, margining, default management, customer protection and whether access should be limited for retail participants.