Global Regulator & Central Bank News Roundup

The Australian Treasury has issued a consultation paper on targeted reforms to reduce compliance costs under Australia’s climate-related financial disclosure framework while maintaining disclosure quality, consistency and international alignment. The proposals focus on adjusting assurance settings, improving guidance on proportionality and materiality, and setting clearer boundaries for value chain information requests, particularly where requests could impose disproportionate costs on small and medium-sized enterprises. Assurance options include retaining limited assurance on an ongoing basis, delaying the transition to reasonable assurance from 2030 to 2035, or applying reasonable assurance only to mature metrics such as Scope 1 and Scope 2 emissions while keeping Scope 3 emissions under limited assurance. The consultation also considers further guidance on applying AASB S2 concepts such as information available without undue cost or effort and statements of no material climate-related risks or opportunities. Measures addressing value chain requests include practical guidance on reasonable supplier information requests and improved access to domestic emissions factors to reduce reliance on primary data collection. The proposals have not received government approval and would not affect entities reporting for the 2026-27 financial year. Any changes would be sequenced to minimise disruption, and the consultation does not seek changes to Scope 3 emissions reporting requirements or the entities required to report under the regime.

The Australian Prudential Regulation Authority (APRA) and the Australian Securities and Investments Commission (ASIC) have published joint insights from nine industry roundtables involving more than 380 entities and 600 attendees, concluding that financial entities must move beyond awareness of frontier AI risks to evidence of implementation, practical testing and measurable resilience outcomes. Frontier AI is accelerating cyber, technology and operational threats, while increasingly autonomous agentic systems may create unintended actions and outcomes. Boards and executives therefore need to demonstrate that their entities can make decisions, maintain critical operations and recover when incidents unfold faster, affect more parties and involve more complex dependencies. The regulators identified four priorities. Entities should strengthen cyber fundamentals, including visibility over critical systems and attack surfaces, timely patching, identity and access controls, monitoring, backup integrity and tested recovery arrangements. Boards should establish risk appetite, escalation authority, supplier-reliance parameters, recovery priorities and communication strategies before a crisis, then test those decisions under compressed timeframes. Defensive AI may support threat intelligence, vulnerability detection, code review and incident response, but current capability remains limited and requires governance, secure configuration, reliability testing and human oversight. Firms should also map critical third-party dependencies, assess concentration risk, test fallback and reconnection arrangements, and contribute to sector-wide information sharing and incident coordination. The roundtables follow statements by both authorities earlier this year on risks resulting from frontier AI.

The Hong Kong Monetary Authority, Securities and Futures Commission, Insurance Authority and Mandatory Provident Fund Schemes Authority, working with Cyberport, have selected the first cohort of the Generative Artificial Intelligence Sandbox++. The cohort comprises 36 use cases involving 30 financial institutions and 27 technology partners, chosen from nearly 100 proposals based on innovation, technical complexity and potential industry value. The pilots will focus on agentic AI applications that can perform tasks with greater autonomy, including end-to-end customer onboarding, payments, insurance claims and customer interactions. They will also examine how AI can dynamically oversee actions taken by other AI applications, extending the earlier sandbox theme of “AI vs. AI.” Participants will be onboarded to a platform managed by Cyberport’s Artificial Intelligence Supercomputing Centre, with technical trials due to begin later in 2026.

he Bank of Japan published its fiscal 2026 assessment of generative AI use and risk management across 150 financial institutions. More than 90% are using or trialing generative AI, with adoption increasing across all business types and applications expanding from general administrative work into core operations that use customer information. Direct presentation of generative AI-generated outputs to customers remains limited. Most institutions consider generative AI usable for business but in need of improvement. Progress is strongest in information management, internal rules, human-in-the-loop controls, guidelines and IT infrastructure. Governance, third-party risk management, safety and security remain less mature, while business promotion, human resources, data readiness and cybersecurity are among the main unresolved challenges. Of the 136 institutions using or trialing generative AI, 67 are classified as broad-use institutions because they approve confidential-data processing and use or trial generative AI in customer-service-related operations. These institutions generally report more developed risk controls than the remainder. Institutions plan broader integration of generative AI into business processes over the next three years. The report identifies direct customer outputs, autonomous AI agents and frontier AI as areas requiring carefully designed risk management and governance, with senior management expected to lead resource allocation and framework development as adoption expands.

The Securities and Exchange Board of India (SEBI) issued a set of cyber resilience measures for the securities market, establishing a system-driven IT Resilience Index (ITRI) for Market Infrastructure Institutions (MIIs), aligning its Cyber Incident Reporting Portal with the Financial Stability Board’s Format for Incident Reporting Exchange (FIRE), and launching the Cyber Suraksha Portal as a centralized source of cybersecurity information. Under the ITRI framework, MIIs must assess critical systems and related systems across nine weighted parameters, with availability and security carrying the largest weights at 20% each. MIIs must calculate the index half-yearly within 60 days of each half-year, use system-driven computation without manual intervention except for exceptions discussed in advance with their Standing Committee on Technology (SCOT), and provide rolling comparisons of two consecutive half-years and corrective actions to SCOT and their Governing Board. The Industry Standards Forum must finalize sub-parameters and detailed measurement criteria by November 30, 2026. MIIs must operationalize the framework, including an Early Warning System and real-time monitoring of service delivery, by February 28, 2027, with the first ITRI computation covering the half-year ending March 31, 2027. The FIRE alignment introduces common information fields, standardized definitions and consistent classification of incident attributes, while enabling staged reporting from initial notification through intermediate updates and final closure. Regulated entities must report cyber incidents through SEBI’s Cyber Incident Reporting Portal. Separately, the Cyber Suraksha Portal gives market participants centralized access to cybersecurity circulars, vulnerability warnings and incident insights.

The Philippines Securities and Exchange Commission (SEC) is advancing the next phase of its reform agenda, with measures aimed at removing structural barriers to business entry, capital raising and market liquidity. The planned reforms include a proposed One Business Start Date, separate regulatory frameworks for debt and equity offerings, a market-making framework for publicly listed securities and a review of margin trading rules. Under the One Business Start Date proposal, companies could begin commercial operations after securing SEC registration or another primary regulatory license while completing other government permits in parallel. In the capital markets, the SEC is working with the World Bank to make public offering disclosure requirements more proportionate to the type and risks of the securities offered, while collaborating with the Philippine Stock Exchange and Philippine Dealing and Exchange Corp. on market-making rules intended to support trading activity and liquidity. It is also considering refinements to the Personal Equity and Retirement Account framework to encourage greater participation by employers and employees. The reforms will feed into a Philippine Capital Market Master Plan being developed with the Asian Development Bank to provide a long-term strategy for expanding access to capital and improving the competitiveness of the domestic market. In parallel, under the Philippines' 2026 chairship of the ASEAN Capital Markets Forum, the SEC is pursuing initiatives on cross-border listings, ASEAN depositary receipts and greater regional market connectivity.

Thailand’s Securities and Exchange Commission (SEC) is consulting on draft rules for domestic crypto exchange-traded funds and on tougher qualification standards for foreign digital asset custodians used by mutual and private funds. The proposed crypto ETF regime would require an asset management company to operate each fund as a passive vehicle with average annual net exposure of at least 80 percent of net asset value to a single eligible crypto asset, initially Bitcoin or Ethereum. Crypto ETFs would trade exclusively on the Stock Exchange of Thailand and would primarily use SEC-regulated onshore digital asset custodians, although qualified foreign custodians could be permitted where the SEC considers this necessary and appropriate. Asset managers would have to demonstrate appropriate personnel, systems and service-provider arrangements, provide product-specific disclosures and investor risk education, and could delegate digital asset investment management only to a licensed digital asset fund manager. Mutual and private funds would be permitted to invest in Thai-domiciled crypto ETFs subject to existing investment limits. Digital asset custodians and other suitably prepared digital asset businesses could also register as mutual fund supervisors for crypto ETFs, while custody of the underlying digital assets would have to remain with a licensed digital asset custodian. The proposals would also prohibit margin lending to finance purchases of crypto ETFs. Under the separate custody proposal, foreign digital asset custodians serving mutual and private funds investing in digital assets would have to meet the existing qualification requirements for foreign custodians and be supervised either by an International Organization of Securities Commissions member regulator that is a Signatory A to the Multilateral Memorandum of Understanding or by a regulator in a jurisdiction designated by the SEC as having adequate supervisory and investor asset protection standards. The SEC is considering an initial list of 11 jurisdictions comprising South Korea, Hong Kong SAR, Japan, France, Malaysia, Germany, Luxembourg, Liechtenstein, Singapore, the United States and Ireland. Existing mutual and private funds established before the new requirements take effect would have 120 days to comply, and the SEC expects the rules to take effect within 2026.

The Astana Financial Services Authority (AFSA) has introduced a fast-track authorisation process for financial firms already licensed and supervised under eight regulatory regimes it considers acceptable. The framework allows eligible firms seeking equivalent regulated activities in the Astana International Financial Centre to submit a reduced application package and enables AFSA to rely, on a risk-sensitive basis, on aspects of home regulator supervision while maintaining AIFC regulatory requirements. The initial acceptable regimes cover the UK Financial Conduct Authority, Australian Securities and Investments Commission, Monetary Authority of Singapore, Securities and Futures Commission of Hong Kong, Hong Kong Monetary Authority, Financial Services Regulatory Authority of Abu Dhabi Global Market, Dubai Financial Services Authority and Qatar Financial Centre Regulatory Authority. The fast-track process covers a range of investment, fund management and administration, custody, representative office and credit-related activities. Eligible firms may enter through a subsidiary, branch or representative office. Certain fitness and propriety and systems and controls matters may be addressed through post-authorisation supervisory engagement rather than before licensing. The streamlined measures apply only to authorisation. AFSA retains its ongoing supervisory and enforcement powers and may request additional information, conduct further assessments or return an application to the standard authorisation process where warranted by risk.

The New Zealand Financial Markets Authority has published research drawing on a literature review, two discussion forums and a survey of 952 Māori, finding that insurance is valued by Māori but the current system does not consistently meet the needs of individuals, whānau (family groups), hapū (kinship groups) and iwi (tribes). Affordability is the clearest barrier, identified by 82 percent of survey participants, while 55 percent cited limited trust that insurers would pay claims and 52 percent considered the industry's lack of understanding of Māori communities a factor in lower insurance uptake. The research also found that standard policy structures, valuation methods and assumptions about individual ownership do not adequately accommodate whenua Māori (Māori land), papakāinga (communal Māori housing settlements), marae (communal places used by families and kinship groups for cultural, social and other purposes), or multiple and collectively owned land. These constraints can leave assets uninsured or underinsured and can result in premiums or valuations that do not adequately reflect actual risk or the cultural and intergenerational value of the assets. Seventeen percent of participants had experienced an insurance problem in the previous two years, compared with 9 percent in a similar survey of the general population. Common problems included sales pressure, unclear or unfair terms, overly complicated information and unresponsive providers or brokers. Among participants involved with multiple owned land who knew its insurance status, 12 percent reported an insurance issue, including affordability, governance difficulties, limited coverage and administrative barriers. Participants strongly supported iwi-led insurance approaches and access to trusted claims navigators, with 71 percent backing each option, while 62 percent supported insurance offered to collectives such as whānau or hapū. The report presents these findings as a basis for further work on Māori-led product design, clearer information, stronger cultural understanding within the insurance sector, collective insurance models and responses to climate-related affordability and availability pressures.

The European Banking Authority has launched a consultation on draft regulatory technical standards establishing a harmonised minimum operational risk management framework for all institutions under Article 323 of the Capital Requirements Regulation. The framework is built around three interrelated components: governance, an ongoing operational risk management process and an operational risk assessment system, with the aim of embedding operational risk management across institutions’ activities and decision-making. The governance requirements would assign responsibility for approving and overseeing the framework and operational risk appetite to the management body, while senior management would manage exposures within that appetite and an independent second-line operational risk management function would provide oversight and challenge. Institutions would be required to continuously identify, assess, monitor, control, mitigate and report operational risk, supported by an assessment system using loss and incident data as well as forward-looking tools such as risk and control assessments, key indicators, scenario analysis and stress testing. The standards would also establish related requirements for operational risk data and taxonomy, reporting, compliance, internal validation, audit and data governance. ICT risk would remain integrated into the broader framework, with institutions able to rely on relevant arrangements established under the Digital Operational Resilience Act where these satisfy the proposed requirements. The framework would apply proportionately, with a EUR 750 million business indicator threshold determining several key requirements. Institutions below the threshold could review framework effectiveness at least every two years, use the business indicator as the sole proxy for operational risk appetite, maintain a reduced operational risk data set and report their operational risk profile to the management body at least annually. Institutions at or above the threshold would face annual reviews, quantitative risk limits, an extended data set including near misses and forward-looking assessment outputs, mandatory taxonomy consistency requirements and at least quarterly reporting.

In a new blog post, the European Central Bank analyzes Consumer Expectations Survey data showing that workplace artificial intelligence use among euro area workers doubled from 26% in 2024 to 52% in 2026. The median user reports saving three hours a week, equivalent to 7.7% of median working time, but the estimated economy-wide efficiency gain falls to about 3.8% because only 48.8% of workers both use AI and report time savings. Productivity effects also depend on whether the freed capacity generates additional output. Adoption and gains vary substantially. University-educated workers report 61% adoption compared with 37% among those with lower education, while younger workers are about 20 percentage points more likely to use AI than older colleagues. Coding delivers the largest reported savings at nearly eight hours a week but is used by only about 8% of workers, while more common uses such as research, writing and editing produce smaller savings. About half of workers still do not use AI. One third consider it irrelevant to their tasks, while other barriers include a preference for traditional methods, accuracy and reliability concerns, limited employer provision and lack of interest. Around half of workers identify better training and a clearer understanding of AI’s usefulness as potential incentives, while about half of firms plan to invest in AI training over the next 12 months.

HM Treasury announced plans to give the Bank of England a secondary objective to support innovation in systemic payment systems and emerging forms of digital money, while preserving financial stability as its primary objective. The new mandate would extend the Bank’s existing secondary innovation objective for central counterparties and central securities depositories to payment systems, including those using digital settlement assets such as stablecoins. The objective would remain subordinate to financial stability and would not require the Bank to support innovation where doing so could undermine that mandate. The Bank would report annually to Parliament on how it is advancing the objective. The government expects to implement the change through amendments to the Financial Services and Markets Bill, which is due to be debated in the House of Lords on September 7 and 9.

The German Federal Financial Supervisory Authority (BaFin) has issued a proportional risk management framework for small and medium-sized investment firms, including their foreign branches, that takes effect on Jan. 1, 2027. The framework requires firms to maintain an appropriate business organization and effective risk management designed to protect customers, support market integrity and solvency, and mitigate the risk of a disorderly wind-down. Large investment firms are excluded and remain subject to the risk management requirements applicable to credit institutions. Firms must regularly and, where appropriate, on an event-driven basis identify and assess their material risks across the institution, including risks to customers, markets and the firm, liquidity risks, other material risks, risk concentrations and information and communications technology risks. Environmental, social and governance risks must be considered as risk drivers. The framework also sets expectations for governance, business and risk strategies, capital planning, internal controls, compliance, risk management and internal audit functions, stress testing and risk reporting. Requirements are calibrated to firms’ size, business model and risk profile, with additional obligations for medium-sized firms in areas including risk-bearing capacity, stress testing, liquidity resources and assessment of the time and costs required for an orderly wind-down. For outsourcing, firms must assess associated risks, retain effective oversight and sufficient in-house expertise, and ensure that management responsibility is not transferred to service providers. Material outsourcing arrangements are subject to contractual, monitoring and continuity requirements, while each firm must maintain central outsourcing management proportionate to the nature and risk of its outsourcing. Outsourcing must not reduce a firm to an empty shell, and ICT services subject to the EU Digital Operational Resilience Act are outside the scope of these outsourcing requirements.

The Brazilian Securities and Exchange Commission (CVM) has clarified how companies should apply the sustainability reporting framework after Resolution 244 amended Resolution 193 in May 2026. Resolution 244 removed the planned mandatory adoption of sustainability-related financial reporting for listed companies and instead kept reporting under the Brazilian Committee for Sustainability Pronouncements (CBPS) and International Sustainability Standards Board (ISSB) standards voluntary. It also requires companies that opt into the regime to report for at least three consecutive fiscal years and, from 2027, requires listed companies that do not file a report to explain that decision. The new circular letter provides guidance on how these revised rules apply in practice. A central clarification concerns when a sustainability disclosure falls within Resolution 193. A report that claims or implies compliance with the CBPS/ISSB standards, including by describing itself as aligned with, based on or inspired by them, must meet the applicable requirements in full and include an explicit, unreserved statement of compliance. A report prepared under another framework, such as the Global Reporting Initiative, does not become subject to Resolution 193 simply because it contains information or metrics that also appear in the CBPS/ISSB standards. In determining whether the regime applies, the CVM will consider factors including the framework identified by the company, the purpose and presentation of the report and its connectivity with the financial statements. The circular also explains how companies should move from the previous regime to the rules introduced by Resolution 244. Companies that adopted voluntary reporting under the earlier framework are not automatically subject to the new three-year continuity requirement unless they choose to report for fiscal years beginning on or after Jan. 1, 2026. Earlier voluntary adopters retain the previous filing deadlines and may continue to use the former transition reliefs through fiscal 2026, while companies entering the new regime may use the CBPS/ISSB reliefs only in their initial year of adoption. From Jan. 1, 2027, a listed company that chooses not to file a sustainability-related financial information report must explain its decision in a market announcement by the deadline for filing its annual financial statements, with enough detail for investors to understand the reasons behind the decision.

The Bank of Mexico and the National Banking and Securities Commission (CNBV) have launched a public consultation on draft rules that would overhaul Mexico’s card payment network framework. The proposal has two main pillars: a phased reduction in interchange fees and stronger interoperability requirements designed to ensure that point-of-sale terminals accept cards regardless of the issuer, acquirer or payment network. The draft would ultimately cap interchange fees for cards not issued under credit agreements at MXN 10.80 per transaction and 0.30% of transaction value over a consecutive 12-month period. For credit cards, the corresponding limits would be 1.30% per transaction and 1.00% over 12 months. The caps would be introduced gradually, with higher limits applying during an initial transition before stepping down to the final levels. Issuers could continue to differentiate interchange fees within the applicable caps, but only where justified by real and verifiable costs. The proposal would also strengthen competition and transparency requirements across the card payment ecosystem. Participants would be prohibited from restricting or slowing transactions from other networks, imposing certain tied arrangements or otherwise limiting network access or interoperability. It would introduce CNBV registration for card payment network participants and require prior registration with the Bank of Mexico of interchange fees, merchant discount rates and other charges. Acquirers and aggregators would also have to accept authorization and refund requests regardless of the card issuer and settle authorized payment funds to merchants on the same calendar day they receive them. Existing participants would be subject to staged implementation periods, including 90 days to apply for CNBV registration and 180 days to align participation terms and register interchange fees after the rules take effect.

The Bermuda Monetary Authority (BMA) has revised its policy direction for digital identity regulation, concluding that digital identification solutions can be more effectively supported through targeted enhancements to the existing Anti-Money Laundering and Anti-Terrorist Financing framework rather than a standalone prudential licensing regime for Digital Identity Service Provider Business. The Authority found limited evidence of a sustainable commercial basis for a domestic licensed market and identified regulatory uncertainty over the use of digital identity solutions, particularly those operating under foreign frameworks, as the more immediate issue. The Authority will conduct a targeted review of the AML/ATF framework and develop supervisory guidance for regulated financial institutions on using digital identification solutions for customer due diligence. The guidance will address digital onboarding and identification and verification requirements, reliability, independence and assurance assessments, foreign digital identity frameworks, record-keeping and digital identity lifecycle considerations. Regulated financial institutions will remain responsible for determining whether solutions are sufficiently reliable and appropriate for the relevant risks and for compliance with applicable AML/ATF obligations. The BMA may consult on the proposed guidance and will continue monitoring international developments in digital identity, assurance and interoperability and may reconsider other policy options as the global framework evolves.

Bank of Ghana Governor Johnson Pandit Asiama formally inaugurated the Virtual Assets Coordinating Committee, establishing the statutory platform for joint implementation and oversight of the Virtual Asset Service Providers Act, 2025 (Act 1154). The step advances Ghana’s move from legislation to an operational regulatory framework, building on ongoing work by the Bank of Ghana and Securities and Exchange Commission on licensing and implementation rules. The committee comprises representatives from the two regulators, the Ministry of Finance, Cyber Security Authority and Financial Intelligence Centre, with scope to co-opt other institutions. The Bank of Ghana will hold the inaugural chairmanship for two years before it rotates to the Securities and Exchange Commission. Its mandate includes harmonizing implementation of the act and subsidiary instruments, strengthening information sharing, coordinating responses to emerging risks and addressing financial stability, financial crime, cybersecurity and consumer protection concerns.

Zimbabwe’s Financial Intelligence Unit has presented the country’s first national assessment of money laundering, terrorist financing and proliferation financing risks associated with virtual assets and virtual asset service providers for 2019-2024. The assessment rates the sector’s overall ML/TF/PF risk as medium low, reflecting medium-low threat and vulnerability levels in a nascent market with limited adoption, limited interaction with the traditional financial sector and no significant recorded ML or TF abuse. It nevertheless identifies material potential for abuse because Zimbabwe lacks a regulatory framework and virtual asset activity is largely conducted through informal peer-to-peer channels. Risk varies across activities. Non-custodial wallets and virtual asset exchanges were assessed as presenting medium residual risk, initial coin offerings as medium low, and custodial hot wallets and information providers as low. At the time of the assessment, no VASPs were registered or licensed in Zimbabwe as there was no legal framework for licensing and registration, while some exchanges had not implemented AML/CFT measures. The assessment also found that virtual asset transactions are predominantly peer to peer and largely outside formal financial channels. The assessment recommends establishing a legal framework covering VASP licensing, supervision and monitoring, as well as consumer protection, data protection, market discipline and taxation. It also recommends using a regulatory sandbox as an alternative while a comprehensive framework is developed, strengthening capacity and public awareness, and requiring VASPs to implement risk-based AML/CFT frameworks once the legal framework is in place.

The Central Bank of Syria reported an agreement with Saudi and Syrian business council representatives to establish a joint Saudi-Syrian bank and develop a banking partnership backed by businesspeople and investors from both countries. The measures are intended to create more effective banking channels for investment between Syria and Saudi Arabia. The discussions focused on direct, regulated links between banks and practical transfer mechanisms for funds connected to major investment projects, particularly in tourism and real estate. The parties also agreed to continue coordination to facilitate Saudi investment in Syria and strengthen engagement between the two countries’ business communities.

The U.S. Department of the Treasury announced the launch of a dedicated quantum-readiness task force, a public-private initiative to accelerate the financial sector’s transition to quantum-safe technology in an orderly and operationally resilient manner. The initiative follows Executive Order 14412 and builds on the G7 Cyber Expert Group roadmap for the transition to post-quantum cryptography. The Task Force will operate through three workstreams covering sector alignment and the post-quantum cryptography transition, third-party and vendor readiness, and risks related to digital assets and emerging technologies. It will bring together government, financial institutions, financial market infrastructures, technology providers and other private-sector participants to identify critical dependencies, improve cryptographic agility and interoperability, strengthen operational resilience, and address implementation challenges involving third parties and digital assets.

The U.S. Department of the Treasury launched Operation Economic Outcast, a sustained campaign to restrict Iran’s access to global financial and commercial channels. The Office of Foreign Assets Control issued five sectoral determinations under Executive Order 13902 covering digital assets, technology, gold, aviation and shipping, expanding its ability to sanction foreign persons operating in or supporting those sectors. Treasury also expanded secondary sanctions exposure for Iran-related activity and said enforcement will accelerate. OFAC sanctioned nearly 60 entities, individuals and vessels across networks involved in sensitive nuclear and missile technology procurement, cyber activity and Iranian oil revenue generation, including procurement intermediaries, shadow-fleet facilitators and commodities traders. It also suspended several general licenses and issued additional guidance on sanctions risks associated with Iranian demands concerning shipping in the Strait of Hormuz. As a further measure under Operation Economic Outcast, FinCEN proposed designating Banque Misr UAE as a financial institution of primary money laundering concern under Section 311 of the USA PATRIOT Act and prohibiting U.S. financial institutions from opening or maintaining correspondent accounts for or on behalf of the bank. Treasury estimates that Banque Misr UAE processed approximately $1.8 billion between January 2024 and June 2026 for 103 companies potentially linked to Iranian shadow banking networks. In response to the measure, the Central Bank of the UAE ordered an urgent special inspection of Banque Misr’s UAE branches. OFAC also designated Reza Mohammad Taeedi, general manager of Bank Melli’s Dubai branch, and Hong Kong-based Kameng Trading Limited for facilitating Iran-related financial activity.

The Canadian Securities Administrators (CSA) and the Canadian Investment Regulatory Organization (CIRO) have clarified the regulatory treatment of certain prediction market contracts, building on their earlier guidance on the application of securities and derivatives rules to event contracts. CSA staff take the view that contracts based on sports or entertainment events or outcomes should fall outside securities and derivatives legislation, while CIRO staff do not consider it appropriate to facilitate or approve applications from dealer members to trade these products. The position does not extend to other categories of event contracts, whose regulatory treatment remains under review. In the meantime, the two CIRO investment dealer members already authorized to facilitate event contract trading may offer only a limited range of contracts based on economic, environmental or financial indicators and traded and cleared through specified U.S.-regulated exchanges and clearing houses. Trading outside those permitted categories has not been authorized, and the applicable terms and conditions remain subject to further restriction or change. Event contracts that qualify as securities or derivatives continue to be subject to applicable regulatory requirements, including registration or recognition obligations and, in some jurisdictions, Multilateral Instrument 91-102 Prohibition of Binary Options.

The Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation finalized a rule that refocuses enforcement and supervision on material financial risks at institutions they oversee. It defines an unsafe or unsound practice as conduct that is contrary to generally accepted standards of prudent operation and, if continued, is likely to materially harm an institution’s financial condition or present a material risk of loss to the Deposit Insurance Fund, or that has already caused material financial harm. The rule applies only to supervised institutions and excludes institution-affiliated parties, whose enforcement cases will remain subject to the agencies’ prior standards and procedures. The rule sets a lower threshold for Matters Requiring Attention than for unsafe or unsound practices, allowing examiners to issue an MRA where imprudent conduct could reasonably be expected, under current or reasonably foreseeable conditions, to cause material financial harm or present a material risk of loss to the Deposit Insurance Fund. An MRA may also address an actual violation of a banking or banking-related law or regulation. For violations, the agencies intend to reserve MRAs for substantive breaches, including patterned or systemic violations, those with more-than-minimal adverse impacts or restitution, and insider misconduct or self-dealing. Other violations may be ordered remediated without an MRA, while supervisory observations remain informal and do not require corrective action or presentation to the institution’s board. The agencies must base determinations on objective facts and sound reasoning and tailor their approach to each institution’s capital structure, complexity, activities, asset size and other financial risk factors. As an institution’s risk profile increases, the materiality threshold decreases, assessments become more granular, and remediation requirements and expectations for prudent operation increase.