Global Regulator & Central Bank News Roundup

The Hong Kong Monetary Authority (HKMA) haspublished a whitepaper and the first Quantum Preparedness Index to benchmark and guide Authorized Institutions’ readiness for quantum-related risks and the transition to post-quantum cryptography. The initial index score of 2.3 out of 10 places the sector at an early stage. The whitepaper distinguishes between quantum computing’s longer-term potential in areas such as risk modelling, portfolio optimisation, fraud detection and pricing, and the more immediate need to address cyber risk.n\nSurvey findings show that awareness is developing faster than implementation. Around 68% of respondents reported at least basic awareness of quantum computing, half had discussed it at board level and 32% had begun exploring or piloting quantum-related initiatives. However, the sector scored only 2.4 for Awareness, 2.5 for Planning, 1.8 for Pilots and 2.3 for Practical Preparedness. Formal governance, dedicated funding, workforce training, quantum-risk assessments, cryptographic inventories, approved migration strategies, testing arrangements and progress monitoring remain limited across most institutions. In particular, 66% had not assessed their quantum-related exposure, half had no post-quantum remediation strategy and 71% had neither conducted nor planned proof-of-concept or live testing. Progress is also constrained by the lack of established assessment methodologies, the complexity of identifying cryptography across legacy systems, technical debt, uncertainty over standards and timelines, and dependence on vendors, financial market infrastructures and shared service providers. The whitepaper sets out a four-stage transition approach covering Awareness, Planning, Pilots and Practical Preparedness. It calls on institutions to treat quantum risk as an enterprise risk, establish accountable senior ownership, build and maintain a Cryptographic Bill of Materials, prioritise systems according to data sensitivity and operational criticality, engage critical vendors, test interoperability and rollback arrangements, and embed post-quantum readiness into technology risk, operational resilience, third-party risk and change governance. Immediate steps include placing quantum risk on board agendas, appointing an executive owner, commissioning a cryptographic inventory and requesting post-quantum roadmaps from key suppliers. The Hong Kong Monetary Authority aims to achieve full sectoral readiness, represented by an index score of 10, by 2030 and will support the transition through a post-quantum cryptography toolkit developed with The Hong Kong University of Science and Technology and the industry, targeted training and workshops, and forums involving banks, technology providers, financial market infrastructures and other stakeholders.

The Monetary Authority of Singapore (MAS) and the Association of Banks in Singapore have established the AI-Driven Cyber and Technology Risk Taskforce, an industry-wide initiative to strengthen the financial sector’s collective resilience against cyber and technology risks arising from frontier artificial intelligence models. The taskforce will coordinate sector-wide preparations for threats that can identify and exploit vulnerabilities rapidly and automate attacks at scale. The taskforce brings together cybersecurity, technology resilience and AI leaders from the authorities, major banks, Singapore Exchange and financial infrastructure providers. Its work will focus on sharing AI cybersecurity use cases and expertise, improving cyber defence capabilities through knowledge building and proof-of-concept trials of advanced AI-enabled tools, and developing guidance on measures, controls and solutions for detecting, preventing and responding to sophisticated AI-enabled threats.

The Australian Securities and Investments Commission (ASIC) has published a review of mortgage offset account practices at eight banks representing more than 70% of Australia’s home loan market, finding gaps at every bank in how accounts were set up, linked, monitored and managed. A mortgage offset account is a transaction account linked to an eligible home loan, with its balance reducing the portion of the loan on which interest is calculated. When the arrangement fails, scheduled repayments generally do not change, so customers can unknowingly pay more interest and take longer to repay their loans. Banks paid more than AUD 55 million in compensation for failures reported between September 2023 and August 2025, with further payments expected. The review points to weak end-to-end controls rather than isolated processing mistakes. Some banks could not readily establish whether or when customers had requested an offset account, particularly after refinancing, product changes or other changes during the life of a loan. Seven of the eight banks relied on manual processing for these requests, and staff errors accounted for 86% of the failures identified in the banks’ data. More than half of the failures involved accounts that had been opened but not linked. Detection was also poor: banks had not identified 77% of the reported failures before ASIC requested the data, and the low number of failures they initially reported was inconsistent with customer complaints, remediation programs and other evidence reviewed by the regulator. In some cases, banks also failed to assess customer losses promptly, delayed fixes to known control gaps or only considered compensation after a customer complained. ASIC expects banks to strengthen how they record customer instructions, monitor offset accounts throughout the loan lifecycle and prevent errors in manual processes. It also expects prompt investigation and compensation when failures occur, together with clearer digital information showing whether an account is linked and delivering interest savings.

The Reserve Bank of India (RBI) has issued 64 final Master Directions consolidating the supervisory instructions administered by its Department of Supervision and repealed 628 circulars with immediate effect. The measure completes the supervisory consolidation exercise launched in April 2026, when the RBI published draft directions for comment as part of a broader effort to rationalize its rulebook, improve the accessibility and clarity of requirements and reduce the compliance burden on regulated entities. The Master Directions consolidate existing instructions on an “as is” basis across up to nine functional areas for 11 categories of regulated entities, including banks, non-banking financial companies, co-operative banks, asset reconstruction companies and credit information companies. They will serve as the sole library of supervisory instructions administered by the Department of Supervision. The repealed circulars comprise requirements incorporated into the consolidated Directions and instructions considered obsolete or redundant. The RBI finalized the Directions after receiving 767 stakeholder comments on the April drafts and incorporating feedback relating to clarity and accuracy. Suggestions requiring substantive review fell outside the consolidation exercise and will be considered separately. Actions already taken or initiated under the repealed instruments will continue to be governed by their provisions.

Bank of Indonesia said Perry Warjiyo resigned as governor on 25 July 2026 for personal reasons and that, following a Board of Governors meeting on 26 July 2026, Senior Deputy Governor Destry Damayanti was appointed acting governor under the Bank Indonesia Law, while the central bank said it will maintain continuity in carrying out its duties on rupiah stability, payment system stability and financial system stability.

Chinese authorities including the National Financial Regulatory Administration, the People’s Bank of China, the China Securities Regulatory Commission and the Ministry of Finance have issued a sector-wide governance framework for financial institutions. By 2029, the authorities aim to establish clearer decision-making responsibilities, incentives that reflect long-term risk, stronger risk management and more effective operations, alongside closer integration of Party leadership and corporate governance, including Party committee review of major business and management matters before decisions are taken. The framework directly applies to institutions authorized by the central financial regulators and is intended to serve as a reference for policy financial institutions and local financial organizations. The framework places particular emphasis on the identification of major shareholders, actual controllers and beneficial owners to establish who ultimately owns or controls a financial institution. This includes identifying concealed control, related-party and coordinated shareholding arrangements, and preventing unsuitable or highly leveraged investors from becoming major shareholders or controllers. Financial institutions must strengthen board oversight and the role of independent directors, hold senior management accountable to the board and link remuneration more closely to long-term performance and risk through deferral and clawback arrangements. They must also maintain independent internal audit and manage risks, capital and related-party transactions across the wider group.

European Central Bank (ECB) Banking Supervision has published the final results of its 2026 thematic reverse stress test, covering 110 euro area significant institutions. Each bank was required to design a bank-specific geopolitical risk scenario capable of reducing its Common Equity Tier 1 ratio by at least 300 basis points, with about 20% of banks choosing a higher depletion target. Banks then assessed how the scenario would affect capital, liquidity and non-financial risks, and identified management actions that could mitigate the impact. The exercise was conducted within the internal capital adequacy assessment process framework and did not permit assumptions of fiscal or government support beyond measures already approved. Most banks demonstrated a sound understanding of how geopolitical events could affect their income, solvency and liquidity, and generally translated their scenarios into economically meaningful capital impacts. Common scenario triggers included military conflicts, supply chain and energy disruptions, economic sanctions, political instability, macroeconomic confidence shocks and cyberattacks. About a quarter of participating banks explicitly included a Middle East conflict, including closure of the Strait of Hormuz, while other frequently cited risks included escalation of the war in Ukraine, China-US trade disruption and tensions in the Strait of Taiwan. Capital depletion was commonly driven by higher loan impairment losses or lower net interest income, with fee and trading income also contributing at banks with substantial capital markets activities. Projected credit losses were concentrated in sectors exposed to trade, energy and supply chain disruption, including agriculture, manufacturing, construction, transport, and accommodation and food services. The exercise nevertheless identified material weaknesses in some banks’ stress-testing frameworks. These included insufficiently granular assessments of vulnerable sectors and portfolios, limited sensitivity of models to severe scenarios, inconsistencies between scenario narratives and projected risk impacts, and overly optimistic assumptions about balance sheet growth during systemic stress. Solvency and liquidity interactions were also not adequately captured by many institutions. Although the median liquidity coverage ratio declined from 186% to 163% over the one-year stress horizon and generally remained above the 100% regulatory minimum, foreign-currency liquidity positions were tighter, with some banks falling below 100%. Several institutions also projected limited liquidity stress despite the assumed 300-basis-point capital depletion, raising concerns about their treatment of funding, rollover and cross-currency risks. Non-financial risks featured prominently in banks’ scenarios, particularly cyber and operational disruption. Eighty-six banks identified cyberattacks as a relevant operational risk and 57 ranked them as the principal disruption, while other common risks included failures of third-party service providers and disruptions affecting clients, products and business practices. Banks proposed a broad range of mitigating actions, including capital raising, asset sales, dividend restrictions, tighter underwriting, reduced new business, exposure management, repricing and cost reductions. The ECB found that some actions may be difficult to implement or less effective during a systemic crisis, particularly where many banks seek to undertake similar measures simultaneously or rely on favourable market conditions.

The European Central Bank (ECB) has outlined a proposed accessibility framework for the digital euro app that would go beyond the European Accessibility Act and related EN 301 549 requirements by incorporating applicable Web Content Accessibility Guidelines AAA features for mobile payment applications. The app would provide one route to basic digital euro services alongside channels offered by payment service providers, which would remain users’ main point of contact. The framework covers integration with assistive technologies, users’ perception and operability, and cognitive accessibility. Users would be able to choose between keyboard, touch and stylus input, while all functions would be accessible by keyboard with clearly visible focus indicators. The app would support screen readers and voiceover tools, use enhanced contrast and accessible visual presentation for text, images and controls. It would also warn users before inactivity time-outs that could cause data loss and allow animations to be deactivated. Cognitive accessibility measures would include context-sensitive help, safeguards allowing users to confirm, correct or reverse submissions, and simplified language set at a lower secondary education level. The app would also avoid abbreviations, technical jargon and words with potentially ambiguous pronunciation. The ECB will incorporate the requirements into the app delivery plan and validate them through testing with the ONCE Foundation, ECB staff and 19 national central banks.

As of August 2, the European Commission has begun enforcing the Artificial Intelligence Act through the European AI Office and national authorities and started applying new transparency obligations under Article 50. Providers of interactive AI systems, including chatbots, AI agents and avatars, must inform users when they are interacting with AI. Providers of in-scope systems that generate or manipulate audio, images, video or text must apply machine-readable marks and make outputs detectable. Professional deployers must clearly label deepfakes and AI-generated or manipulated public-interest text that has not undergone substantive human review or editorial control, while deployers of emotion recognition and biometric categorisation systems must inform affected individuals. Disclosures must be clear, distinguishable and accessible by the first interaction or exposure. Enforcement is divided among the European AI Office, national competent authorities and the European Data Protection Supervisor, depending on the system and deployer. The AI Office can also enforce requirements for general purpose AI model providers, including documentation, copyright policies and public summaries of training content, with additional duties for models posing systemic risks, as well as prohibited AI practices. The Commission has issued implementation guidelines, published a first list of more than 180 organisations that have signed the transparency Code of Practice and launched complaint, whistleblower and downstream provider reporting channels. Breaches of the transparency rules may attract fines of up to EUR 15 million or 3% of worldwide annual turnover for companies, and up to EUR 750,000 for EU institutions, with proportionality applied to smaller firms. The AI Omnibus gives generative AI systems placed on the market or put into service before 2 August 2026 until 2 December 2026 to comply with machine-readable marking and detection requirements, but interactive-system disclosure applies from 2 August 2026. It postpones high risk AI rules to 2 December 2027, or 2 August 2028 for systems integrated into regulated products, and introduces prohibitions on systems that generate non-consensual sexually explicit content and child sexual abuse material from 2 December 2026.

The European Supervisory Authorities (ESAs) have published a joint statement calling for a cross-sectoral, risk-based and consistent supervisory approach to ICT and cyber risks from frontier AI models. Financial entities are urged to strengthen governance and risk management under the existing Digital Operational Resilience Act and AI Act frameworks. Management bodies should assign clear accountability, maintain effective response plans, allocate sufficient resources and review risk appetite metrics, tolerance thresholds and controls covering both direct and indirect exposure to frontier AI risks. The statement organizes mitigation around prevention, detection and management. Entities should maintain current inventories of critical and exposed ICT assets, embed security and resilience by design, reduce attack surfaces, accelerate patching and monitor supply-chain dependencies. They should also move toward continuous vulnerability scanning and behavioural monitoring, test incident response and business continuity arrangements against AI-assisted and multi-system failures, protect backups and monitor interconnected dependencies. Measures should be proportionate to each entity’s size, risk profile and operational complexity. The authorities have begun targeted engagement with relevant critical ICT third-party providers and are incorporating the findings into the 2027 Oversight Plan. AI-related risks are also being embedded in the Oversight Examination Methodology and are expected to feature in 2027 examinations and other oversight work assessing provider preparedness and resilience.

The European Insurance and Occupational Pensions Authority's (EIOPA) latest risk dashboards show rising macroeconomic and cyber pressures across the European Union insurance sector and European Economic Area institutions for occupational retirement provision. Macroeconomic risks are medium but increasing as growth expectations weaken, inflation forecasts rise and geopolitical tensions add downside and cost pressures. Market risks are high in both sectors. Although equity and bond volatility eased through end-June, the 12-month outlook points to higher risk amid elevated valuations, geopolitical uncertainty and the potential for a broader market correction and repricing of risk premia. Digitalisation and cyber risks increased to high for insurers, reflecting more global cyberattacks, systemic risks associated with frontier artificial intelligence models, geopolitical threats and insurers' cyber underwriting exposure. Cyber risk remained medium for IORPs but increased in materiality. Most other risk categories remained broadly stable at medium levels. Insurers' median solvency ratios stood at 210% for groups, 247% for life insurers and 218% for non-life insurers, while strong premium growth was partly offset by deteriorating underwriting performance among some firms. For defined benefit IORPs, reserve and funding risk rose to medium and the median funding ratio was 125.3%, although the transition of Dutch schemes from defined benefit to defined contribution limits comparison with previous quarters.

The Single Resolution Board (SRB) has published its fourth annual assessment of banks’ resolvability across the Banking Union, covering progress during 2025. The report finds that banks strengthened their capabilities across all seven resolvability dimensions and marks the transition from developing resolution capabilities toward their operationalisation, systematic testing and continuous improvement. The strongest gains among banks under the SRB’s remit were in liquidity and funding in resolution, management information systems and data provision, and separability and transferability. Less significant institutions also made material progress, particularly in providing information for resolution planning, valuation and the implementation of resolution actions. Under the SRB’s enhanced assessment methodology, most banks had no material issues or only areas requiring further enhancement for capabilities not subject to phase-in. Banks’ standardised self-assessments broadly aligned with assessments by internal resolution teams, although differences remained where banks considered themselves fully compliant and the teams identified outstanding elements. Divergences were most pronounced in valuation, communication, and separability and transferability, where guidance has recently been enhanced and implementation periods remain in place. Some less significant institutions also need further progress in liquidity reporting, internal loss and capital transfer mechanisms, and operational continuity. The revised framework combines standardised self-assessments, a more granular heatmap and systematic testing, which will become the primary means of assessing whether capabilities work in practice. Multi-annual testing programmes covering 2026–2028 will address all relevant resolvability principles and be calibrated to banks’ size, complexity and progress. For 2026, 214 tests are planned across 78 banks, focusing on bail-in execution, operational continuity, cyber resilience, communication and management information systems. Separately to the report, the SRB also issued operational guidance and a complementary quantitative template for banks preparing Business Reorganisation Plan Analysis Reports in connection with open-bank bail-in resolution strategies. The guidance consolidates and clarifies existing expectations without introducing new requirements.

Germany’s Federal Financial Supervisory Authority (BaFin) has gained responsibility for market surveillance of artificial intelligence systems directly connected with regulated financial activities under Germany’s law implementing the European Union Artificial Intelligence Act. The mandate covers banks, insurers and other BaFin-supervised financial companies, and allows the authority to impose fines for violations. Supervision will cover transparency requirements for systems that interact directly with people, such as customer-facing chatbots, as well as prohibited AI practices and high-risk systems used for creditworthiness assessments or life and health insurance risk assessments. ill integrate this work with its existing firm supervision, while supervised firms and their management remain responsible for transparency, non-discrimination, effective risk management and ensuring that humans can correct or reverse decisions. AI used for other purposes, including personnel management, remains under the Federal Network Agency’s remit. The first transparency requirements apply from August 2, 2026, and requirements for high-risk AI systems apply from December 2, 2027.

The Czech National Bank (CNB) will establish an AI Division within its Information Systems Department from Aug. 1, 2026, consolidating artificial intelligence and machine learning capabilities currently spread across several organizational units. The division will coordinate implementation across the central bank, set development priorities and adapt its AI architecture to support broader practical use. The new team will oversee AI deployment from process and coordination perspectives, working with technical, security and project experts while maintaining data protection and security standards. Janis Aliapulios, currently an adviser to the CNB Bank Board, will lead the division, which will be created by reorganizing existing resources without increasing the central bank’s total number of positions.

The Payment Systems Regulator (PSR) has issued two directions requiring Mastercard and Visa to improve transparency over UK card scheme and processing fees and strengthen governance of pricing decisions. The transparency measures require the schemes to give acquirers clear information on every fee they are charged, including the nature of the fee, what triggers it and how it is calculated. This is intended to help acquirers reconcile bills, avoid unnecessary charges and compare optional services. The action follows a market review that found Mastercard and Visa revenues from scheme and processing fees had risen substantially, the balance of those fees fell primarily on the acquiring side, and average acquirer fees for mandatory services had increased significantly. The regulator also found limited evidence that a specific set of fee changes was driven by cost changes and that the schemes did not consistently document all factors considered when approving fee changes. Under the pricing governance direction, Mastercard and Visa must maintain signed written records for decisions to introduce or modify scheme and processing fees charged to acquirers for UK transactions. The full decision record and pricing principle requirements apply where a fee is reasonably expected to generate more than GBP 250,000 in gross UK revenue in the first full financial year after implementation. Related decisions taken simultaneously or within less than 12 months must be assessed cumulatively where they are primarily based on the same reasons. Each record must explain the fee’s purpose, whether it is new or modified, its structure and drivers, any discounts, rebates or incentives, the basis for approval and any amendments made before approval. It must also document how the operator considered service users’ interests alongside its commercial interests and list the documents provided to the senior managers or pricing committees responsible for the decision. The required assessment must, where reasonably practicable, consider the anticipated first year UK net revenue effect, whether the decision is linked to changes in the operator’s costs, the proportionate financial impact on acquirers, relevant competing services and any service improvements or product investment supporting the fee. Operators must also assess the effects on competition, innovation and payment system resilience. Each operator must further appoint an appropriately senior Executive Manager and establish compliant policies, systems, controls and training within four months of commencement. Annual overviews of fee decisions and signed compliance reports must be submitted within one month after each financial year beginning on or after January 1, 2027.

The Brazilian Securities and Exchange Commission (CVM) has updated its internal structure by creating a Financial Technology Division within the Intelligence Development Superintendency. The changes establish responsibilities for advanced analytical and computational solutions and for developing, implementing and reviewing internal policies on data governance and the ethical and responsible use of artificial intelligence. The new division will monitor technological developments and financial innovation in capital markets, assess their impact on regulated activities and support improvements across the authority. Its initial work will include advising on the securities tokenization project planned for 2026-2027, supporting the next Regulatory Sandbox round and monitoring the International Organization of Securities Commissions Fintech Task Force. The restructuring also adjusts responsibilities across data governance, intelligence development, procurement, intermediary supervision and market monitoring functions.

The Caribbean Development Bank has approved USD 232,000 in grant funding to strengthen Development Finance Institutions across its Borrowing Member Countries. The initiative will provide four specialised training programmes and access to a web-based credit scoring and risk rating platform, supporting institutions that finance small and medium-sized enterprises, climate resilience, renewable energy and sustainable development. At least 11 Development Finance Institutions and more than 300 professionals are expected to benefit. Training will cover SME credit risk management, agriculture and renewable energy financing, environmental, social and governance standards, and climate and sustainability finance instruments. Participating institutions will also receive access to the SME eSMART platform to improve the efficiency and consistency of SME loan assessments. The project will be delivered with Caribbean Information and Credit Rating Services Limited.

The South African Reserve Bank (SARB) and the National Bank of Angola have introduced the Angolan kwanza as a settlement currency in the Southern African Development Community real-time gross settlement system, making it the system’s second settlement currency after the South African rand. Direct settlement in kwanza allows participants to reduce foreign exchange conversions, which can lower transaction costs and accelerate access to funds for regional trade. The SADC-RTGS system has 15 participating countries and processes ZAR 250.7 billion in transactions each month. In 2025, trade and interbank transactions between Angola and the other 14 SADC states totaled approximately USD 3.77 billion across nine currencies, with South Africa accounting for nearly USD 2.99 billion, 60% of transaction volumes and 79% of total value. The multi-currency expansion is intended to increase the use of local and regional currencies and reduce reliance on non-SADC currencies and intermediaries. The authorities intend to onboard additional regional currencies, including the Botswana pula, in due course.

The Central Bank of Egypt, as chair of the African Financial Stability Report Working Group and host of the African Financial Stability Committee Secretariat, led the inaugural continent-wide assessment of financial stability under the Association of African Central Banks. Covering 46 of 54 countries, representing 84% of Africa’s population and 90% of its GDP, the report establishes a common framework for assessing macrofinancial conditions, financial institutions, capital markets and payment systems. It uses data through December 2024 and incorporates regional and global developments assessed during 2025. The assessment of 33 central banks finds that they have implemented an average of 61% of the report’s reference practices for financial stability frameworks, with scores ranging from 0.06 to 0.97 and 18 central banks above the continental average. Progress is strongest where authorities have clear legal mandates, dedicated financial stability functions, regular stress testing and operational macroprudential toolkits. However, significant gaps remain in institutional coordination, policy powers, data quality, supervisory capacity and public communication. Cybersecurity and operational resilience were ranked as the most prominent systemic risks, followed by economic uncertainty and climate-related and environmental, social and governance risks. Africa’s financial system remains bank-dominated, with banking assets equivalent to about 80% of GDP, compared with 46% for non-bank financial institutions and stock market capitalization of 56%. Banking systems were broadly resilient in 2024, with average capital adequacy of 19.7%, but elevated non-performing loans, credit concentration, foreign exchange mismatches, large exposures and sovereign linkages remain important vulnerabilities. Non-bank finance and capital markets are expanding but remain uneven, concentrated and constrained by supervisory and data gaps. Payment systems are modernizing rapidly through mobile money, real-time gross settlement systems and regional initiatives, although fragmentation, limited interoperability, cyber risk and operational weaknesses persist. The report calls for greater harmonization of macroprudential frameworks, stronger regional crisis management and resolution arrangements, further alignment with Basel III and the International Monetary Fund’s Financial Soundness Indicators, and closer integration of payment infrastructure.

The Financial Services Regulatory Authority of Abu Dhabi Global Market (ADGM FSRA) has proposed a more proportionate framework for transfers of financial services businesses. Mandatory court sanctioning under Part 7 of the Financial Services and Markets Regulations would generally be limited to insurance business transfers. Intragroup insurance transfers where all policyholders have consented and reinsurance transfers where policyholder consent, represented by the ceding insurer, has been obtained would be excluded. Other business transfers would instead fall under a new Modified Transfer Scheme regime in Chapter 8A of the General Rulebook. The existing regime for Domestic Funds would remain unchanged. A Modified Transfer Scheme would require prior written notification to the authority, timely direct notice to each client explaining the potential impact of the transfer, and timely public notice. Banks and the two excluded categories of insurance transfer would also need to obtain a no-objection acknowledgement from the authority before proceeding. Firms could still apply for optional court sanctioning, including where a transfer affects many clients, is complex or requires additional legal certainty.

The Central Bank of the UAE (CBUAE) published an update showing that banking sector asset quality reached its strongest recorded levels at the end of the second quarter of 2026. The nonperforming loan ratio fell to 2.8% from 8.2% in 2020, while the net nonperforming loan ratio declined to 1.3% from 3.6%. The stock of nonperforming loans decreased to AED 76 billion from AED 142 billion over the same period. The central bank attributed the improvement to systemwide asset quality reviews, targeted supervision, engagement with banks and risk officers, implementation of its Credit Risk Management Regulation and Standards, and guidance on loan write-offs and recoveries. Its Financial Institutions Resilience Package, adopted in March 2026, has enabled repayment deferrals on about AED 13.5 billion of loans for 135,031 customers temporarily affected. Banking sector loans, deposits and assets increased by 12.5%, 18.1% and 14%, respectively, as of June 30, 2026, compared with the same period in 2025.

The Ontario Securities Commission (OSC) published the third wave of its Crypto Asset Survey, based on 2,360 Canadian adults, finding a broad rebound in retail engagement since 2023. The share correctly identifying crypto assets rose to 59% from 54%, while ownership of crypto assets or crypto investment funds increased to 25% from 10%. Among respondents aware of crypto, 43% believed it already plays a key role in the financial ecosystem, 52% expected it to do so in the future and 38% reported a high likelihood of purchasing within the next 12 months, up 18 percentage points from 2023. Investor protection behaviour improved, but knowledge and conduct risks remain. Half of centralized platform users checked whether their platform was registered, up from 38%, and 67% recalled receiving risk disclosures. However, 49% of Canadians did not know who regulates crypto assets and 24% believed they are unregulated. Centralized platforms remained the main acquisition channel at 59%, while 15% of their users reported financial losses linked to fraud, scams or hacking. Adviser engagement also increased: 39% of investors with financial advisers said they had been recommended to buy crypto assets, generally with an allocation of 10% or less. Awareness remained limited for stablecoins at 34% and real-world asset tokens at 24%, although 74% of those familiar with real-world asset tokens would consider investing if offered through their main bank or investment firm.

The Board of Governors of the Federal Reserve System (FRB) and the Federal Deposit Insurance Corporation (FDIC) have issued coordinated proposals to modernize restrictions on bank lending to executive officers, directors, principal shareholders and their related interests. Both proposals would increase the limit for credit to executive officers not otherwise specifically authorized from USD 100,000 to USD 400,000 and the aggregate insider credit threshold requiring prior board approval from USD 500,000 to USD 2 million. The agencies would eliminate the existing USD 25,000 minimum component, leaving thresholds based on the lower of 2.5% of unimpaired capital and unimpaired surplus or USD 400,000 for the executive officer limit, and the lower of 5% or USD 2 million for prior board approval. The dollar amounts would be adjusted every five years using nominal U.S. gross domestic product, with no downward adjustment following negative cumulative growth. The Federal Reserve Board’s proposal is broader and would comprehensively revise and reorganize Regulation O. It would also raise thresholds for qualifying credit card debt, interest-bearing overdraft plans and inadvertent overdrafts, clarify that certain limits apply on an aggregate basis, and increase the related public disclosure threshold to USD 2 million. Other changes would narrow the application of the presumption of control to portfolio companies held by qualifying passive fund complexes, incorporate statutory requirements and longstanding interpretations, and clarify the scope and valuation of extensions of credit, including derivatives, securities financing transactions, leases, debt securities, modifications and guarantees. The FDIC’s proposal is limited to aligning the two principal thresholds in its rules with the Federal Reserve Board’s approach for FDIC-supervised institutions. The FDIC estimates that up to 1,457 institutions, including 956 small institutions, could be directly affected by the higher board approval threshold and states that the proposal would impose no new reporting requirements or direct costs.

The Commodity Futures Trading Commission (CFTC) has proposed new and amended rules for futures commission merchants, swap execution facilities, designated contract markets and derivatives clearing organizations to establish a consistent baseline for affiliate relationships. The framework combines principles-based conflict management requirements with targeted safeguards for financial oversight, regulatory decision-making, non-public information, proprietary trading and clearing. Vertically integrated structures would remain permitted, subject to controls addressing actual, potential and perceived conflicts of interest. Self-regulatory organizations with affiliate futures commission merchants would need independent examination reporting lines, an independent third-party self-regulatory organization to supervise the affiliate, restrictions on non-public information and a bar on serving as the affiliate’s designated self-regulatory organization. Futures commission merchants could elect a registered futures association as their designated self-regulatory organization, subject to transition and minimum-duration conditions. Designated contract markets and swap execution facilities with affiliate market participants would need procedures covering systems, personnel, office space, conflict documentation and disclosure. An affiliate principal trading firm could trade on an affiliated designated contract market only as a qualifying market maker, subject to last priority at each price level, bona fide market-making obligations, incentive parity, independent surveillance and annual certification, and trading-session disclosure. Derivatives clearing organizations would need to manage and disclose conflicts involving affiliate clearing members, while futures commission merchants would need to disclose relevant affiliate relationships and risks. The proposal would also codify governance standards requiring at least 35% public directors on designated contract market boards and executive committees, public director regulatory oversight committees and public representation on disciplinary panels.

The Office of the Comptroller of the Currency (OCC) and Federal Deposit Insurance Corporation (FDIC) have proposed targeted amendments to their current Community Reinvestment Act rules that would retain the core framework generally applied since 1995 while placing greater emphasis on lending, tightening the treatment of community development grants and reducing burden, particularly for community banks. The proposal follows the court injunction that prevented the 2023 CRA rules from taking effect and would leave the current assessment area framework largely tied to banks’ physical locations. The proposal would classify banks with less than USD 1 billion in assets as small, those with USD 1 billion to USD 10 billion as intermediate and those with more than USD 10 billion as large. Banks with USD 10 billion or less generally would not be subject to CRA data collection, maintenance and reporting requirements and would be evaluated under more flexible performance standards. Retail lending assessments would focus on banks’ major product lines, while the range of retail banking services considered under the service test would be limited to credit services and would exclude deposit services. Intermediate banks could also receive an overall satisfactory rating based on satisfactory lending performance even if their community development test performance were weaker. The proposal would also clarify community development eligibility and strategic plan processes and modernize public file requirements.