Global Regulator & Central Bank News Roundup

Hong Kong authorities advanced separate initiatives aimed at strengthening the financial sector's response to climate risks and supporting the transition to a low-carbon economy. The Insurance Authority (IA) unveiled its Climate Strategy and launched the Climate Insurance Lab (CIL) to strengthen insurer capabilities in climate risk data, regulatory readiness and product development. Separately, the Hong Kong Monetary Authority (HKMA) launched consultation on the Phase 2B prototype of the Hong Kong Taxonomy for Sustainable Finance, expanding the framework's coverage of green and transition activities and climate adaptation. The CIL is designed around shared data infrastructure, practical regulatory guidance and a Product Innovation Platform. Its components include a Climate Risk Portal to narrow data gaps, support scenario testing and provide actuarial models for pricing and product development, alongside work to enhance the ORSA process and develop a comprehensive regulatory framework for sustainability disclosures. The Product Innovation Platform will use cross sector dialogue, workshops and pilot projects to identify priority areas and test viable product concepts. The IA also presented findings from a Climate Modelling Project with the Hong Kong Federation of Insurers and The Hong Kong University of Science and Technology that uses high resolution climate models to support spatial climate risk assessment, underwriting and product innovation. Phase 2B adds 10 economic activities and, after reclassifying some existing activities, increases the total number of activities from 25 to 39. It adds enabling technologies such as battery manufacture and recycling and the manufacture of low carbon technologies, provides transition pathways for sectors including air transport and iron and steel, and introduces a process approach for climate adaptation with 24 measures, comprising 11 whitelist and 13 non-whitelist measures, initially focused on shoreline protection and flood management. Phase 2B also defines four additional environmental objectives covering biodiversity and ecosystems, water resources, pollution prevention and control, and resource efficiency and the circular economy, completing a six objective framework, although the current phase remains focused on climate mitigation and adaptation. The taxonomy is currently designed for voluntary adoption, with incorporation into banking supervisory policies to be explored over the longer term.

he Philippines' Securities and Exchange Commission (SEC) has opened a consultation on revisions to its 2019 crowdfunding rules, covering offering limits and safeguards for online equity and debt crowdfunding. Under the proposed securities registration exemption, eligible issuers could offer an aggregate of up to PHP 25 million to any investors over 12 months, while offerings above PHP 25 million and up to PHP 100 million would be restricted to qualified investors. Retail investors' aggregate purchases across issuers over 12 months would be capped at 5% of total annual income for those earning up to PHP 2 million and 10% for those earning more. Qualified investors would be exempt from these investor limits. Intermediaries would have to hold investor funds in segregated trust or escrow accounts and reconcile them daily. Retail investors would receive a cooling-off period of at least five business days before funds could be released. The draft would prohibit intermediaries from acquiring interests in offerings on their platforms or hosting offerings by specified connected parties. Debt platforms would have to publish their credit assessment methodologies and make each issuer's assessment result or grade available before accepting investment commitments. Each offering would disclose effective interest rates, all fees and total borrowing costs. Investors would have to be notified within five business days of defaults or arrears exceeding 30 days, with platforms required to pursue recovery on investors' behalf and provide regular updates. A regulated backup servicer would have to be appointed before any debt offering. Quarterly disclosures would show loans or debt securities more than 90 days past due as a share of total outstanding debt, alongside default and recovery rates.

The Securities and Exchange Board of India (SEBI) has launched Demat 2.0, a pilot market infrastructure for issuing, holding, trading and settling corporate bonds as digital tokens on a distributed ledger maintained by statutory depositories. The infrastructure connects to the Reserve Bank of India’s wholesale central bank digital currency through its Unified Market Interface, enabling atomic settlement of the securities and funds legs. Smart contracts can also automate interest and redemption payments to bondholders’ CBDC wallets. Three companies have issued tokenised bonds totaling INR 1,025 crore. REC Limited raised INR 500 crore from 18 investors, L&T Limited raised INR 500 crore from four investors, and IIFL raised INR 25 crore from one investor. The model allows issuers to receive funds on the day of bidding rather than two to three days later, provides investors with immediate funds in secondary-market transactions, reduces manual processing and reconciliation, and eliminates settlement risk through atomic settlement. The underlying bonds and investor protections remain unchanged, including requirements for credit ratings, debenture trustees, listing and disclosures. First-phase issuances are ongoing. Later phases are expected to extend the pilot to secondary-market trading through existing request-for-quote platforms and to retail investors, with experience from the pilot informing any wider rollout. Investors will hold the tokenised bonds in their existing demat accounts without a new account or fresh know-your-customer process, but must enable Demat 2.0 with their depository and maintain a wholesale CBDC wallet with a participating bank.

The Australian Prudential Regulation Authority (APRA) has substantially revised its proposed reporting standards for the Government’s Retirement Reporting Framework following industry feedback, reducing reporting complexity while refining the metrics and indicators used to assess member outcomes in retirement. The changes restructure the proposed retirement member profile reporting requirements to reduce reporting granularity and reliance on event-based transaction data, simplify age and member benefit cohorts, and replace broad retirement status classifications with a distinction based on whether members commenced a retirement income stream during the reporting period. APRA has also issued a draft reporting practice guide to support consistent reporting. APRA has revised several methodologies and data requirements. Average pension drawdown will be calculated using actual pension payments rather than selected drawdown rates, while purchase price will remain the denominator for the balance utilisation metric, supplemented by a new years pension held attribute and a derived average balance at death. The investment-linked indicator will extend beyond annuities to other lifetime income products, with additional indicators for deferred products and innovative retirement income streams. APRA has also refined reporting on access to personal financial advice and made targeted exclusions and structural changes affecting legacy products, defined benefit pensions and product access pathways. Publication design and contextualisation will be developed through further industry engagement in 2027, with masking and aggregation used to protect member information. APRA intends to finalise the reporting standards and supporting guidance by the end of 2026, with the first data collection expected in late 2027 and the first Framework indicators and metrics published in 2028. It also intends to revoke an existing retirement income reporting standard by 30 June 2027, with transition guidance to accompany the change.

New Zealand's Department of Internal Affairs has assessed the accounting sector as having Medium inherent money laundering vulnerability and Low-Medium residual risk, with trust and company services and trust accounts rated Medium-High. Trust and company services are particularly exposed because legal persons, trusts, nominee arrangements, shell companies and cross-border structures can obscure beneficial ownership and effective control, create distance between criminals and illicit assets, and lend apparent legitimacy through professional involvement. Trust accounts create a more direct exposure by allowing criminal proceeds already in the financial system to be routed through an accounting practice, obscuring the origin of funds and making onward payments appear to come from a trusted professional. Insolvency services and other management of client funds or assets are rated Medium, reflecting risks including concealment of audit trails, asset stripping, manipulation of creditor payments and misuse of an accountant's authority over client accounts. The assessment also points to evolving exposures. Cyber-enabled fraud volumes and values are expected to rise, with cryptocurrency increasingly used to move fraud proceeds, while accounting practices have significant exposure to the subsequent layering and integration of fraud and drug proceeds and to transnational laundering involving high-value transactions, foreign clients and New Zealand legal structures. Complex international money laundering networks may combine legal persons, multiple financial institutions, gatekeepers and trade-based laundering techniques. Proliferation financing remains Low overall, but trust and company services are rated Medium-High because shell companies and non-transparent corporate structures can support procurement, trade and revenue-raising activities, particularly where clients, transactions or intermediaries have links to North Korea or Iran. Controls are rated only Moderate, with recurring weaknesses in implementation rather than the absence of formal frameworks. Ongoing customer due diligence and account monitoring are less consistently applied than standard due diligence, alongside deficiencies in enhanced due diligence and in examining and documenting high-risk clients, activities and transactions. Some trust and company service providers still identify an instructing law firm, service provider or accounting practice as the customer instead of the legal person or arrangement being acted for. Suspicious activity reporting is also persistently low: only 111 reports were filed between October 1, 2018, and December 31, 2025, by about 6% of practices, with relatively few concerning trust and company services, leading DIA to conclude that some reportable activity is likely not being identified. Wider supervisory gaps remain because there is no mandatory registration with DIA, some reporting entities are likely unknown and outside active supervision.

In its second Trends, Risks and Vulnerabilities Risk Monitor of 2026, the European Securities and Markets Authority (ESMA) warns that resilient markets are masking a widening gap between deteriorating macro-financial conditions and elevated valuations, increasing the risk of abrupt market corrections. The recurring assessment, covering developments in EU financial markets during the first half of 2026, finds that technology and artificial intelligence stocks have helped sustain market valuations despite weaker growth, persistent inflation and heightened geopolitical tensions. ESMA continues to assess market, contagion and operational risks as very high and credit risk as high, and urges retail and institutional investors to maintain robust liquidity buffers against sharp repricing. A correction in US technology stocks could transmit quickly to EU investors, with US equities accounting for 45% of EU equity fund assets and retail investors also increasingly concentrated in US shares. Vulnerabilities extend beyond equities: sovereign bond volatility has risen as yields increased, bond funds’ liquid asset holdings fell to a five-year low, and growing links to US private credit and crypto-assets create additional channels for spillovers. Operational risks are also rising as frontier artificial intelligence compresses the time between vulnerability discovery and exploitation. ESMA warns that cyberattacks affecting systemic financial institutions, market infrastructures or shared technology providers could propagate across the financial system, reinforcing the need for stronger operational resilience, third-party oversight, incident reporting and coordinated testing.

The European Securities and Markets Authority (ESMA) has issued a package aligning prospectus guidance and technical standards with the Listing Act’s streamlined disclosure framework. Building on its earlier clarification of transitional arrangements, the package consults on revised disclosure guidelines, updates prospectus Q&As, finalizes guidelines on when a supplement introduces a new type of security and submits revised requirements for key financial information in prospectus summaries to the European Commission. The proposed disclosure guidelines would remove guidance tied to deleted requirements, add rules for ensuring consistency between management reports and the rest of a prospectus, and require issuers without management reports to include equivalent material information needed for an informed investment decision. They would also consolidate guidance on profit forecasts and risk factors, delete the historical financial information bridge approach following the reduction in required reporting periods, and clarify related party transactions by reference to International Accounting Standard 24. ESMA proposes reducing the framework from 57 guidelines in 18 sections to 49 guidelines in 14 sections. The final product supplement guidelines use prospectus disclosure annexes and product classes to determine when a new base prospectus is required, with refined tests for structured products, asset-backed securities and securities linked to environmental, social and governance factors. Sustainability-linked non-equity securities cannot be introduced by supplement if absent from the base prospectus, while ESG use-of-proceeds disclosures may be added. The revised technical standards shorten historical financial information periods and remove the cash flow table for non-equity securities. The product supplement guidelines will apply two months after publication in all official EU languages, while ESMA expects to publish the final updated disclosure guidelines in the second quarter of 2027.

The Central Bank of Latvia, working with critical financial service providers and merchants, has implemented offline card payments for essential goods when internet or mobile communications are disrupted. Individuals can make purchases totaling up to EUR 200 per card at participating food retailers, petrol stations and pharmacies, extending Latvia’s crisis payment resilience framework beyond access to cash and the critical ATM network. The service covers three grocery chains, four fuel retailers and three pharmacy chains. It is available only for cards issued by Swedbank, SEB banka, Citadele banka and Luminor Bank’s Latvian branch. Customers must insert a physical card into the terminal and enter the PIN. Smart device payments are not supported, and the service cannot operate if the merchant loses electricity.

The Bank of France has published an article introducing the market-implied probability of economic contraction indicator, or PICON, which uses machine learning to measure how financial markets perceive recession risk in the United States and euro area. The indicator applies a random forest model to daily data across equities, sovereign and corporate bonds, currencies, commodities and derivatives, allowing it to capture interactions that yield curve models alone may miss. It should be interpreted as a measure of market perceptions rather than a recession forecast. The model identified three of the four U.S. recessions since 1990 with probabilities above 50% and produced fewer false signals than a benchmark yield curve model during 2022-24. In the 2022-25 test period, it distinguished stress associated with economic concerns, including the European energy crisis, banking failures, prolonged high interest rates and U.S. tariff announcements, from episodes of mainly financial stress. Asset classes contribute differently across time horizons, with equities and credit providing more information in the short term and yield curve slopes becoming dominant after three or four quarters. Against the backdrop of the war in Iran, PICON placed the market-implied probability of a euro area recession within two quarters at 21% as of April 14, 2026.

The Central Bank of Brazil has approved new requirements for the Social, Environmental and Climate Risks and Opportunities Report, expanding disclosures to include standardized quantitative metrics alongside enhanced qualitative information. The rules apply across the four main prudential categories covered by the framework, ranging from the largest and internationally active banks to smaller regulated institutions, although the extent of disclosure varies by institution size. The changes are intended to make institutions’ exposures and risk management practices more comparable, including through standardized disclosure of climate transition plans, where they exist, and voluntary social, environmental and climate commitments. The largest, large and medium-sized institutions will be subject to the full reporting framework, covering governance, strategy and risk management as well as detailed climate, social and environmental risk exposures. Required disclosures include exposures to greenhouse gas intensive sectors, agricultural exposures by crop and livestock activity, geographic exposure to drought and heavy rainfall risks, and exposures to counterparties subject to environmental sanctions or with tailings dams at emergency levels. Smaller institutions in the fourth prudential segment, broadly those below 0.1% of Brazil’s GDP that are not in the separate simplified regime, will face narrower requirements focused on governance and social, environmental and climate commitments. Most provisions take effect on January 1, 2027. Reports must be published annually using a December 31 reference date and generally within 90 days, with additional time permitted for the first report. Medium-sized and smaller institutions may defer specified new disclosures until the December 31, 2028 reference date. Reports must remain publicly available on institutions’ websites for five years and the required information must also be provided in open data format.

The Jordan Securities Commission has launched its Environmental, Social and Governance Code, moving from its earlier approval and announced rollout plans to a mandatory first phase for the 20 companies in the Amman Stock Exchange ASE20 index from financial year 2027. Those companies must apply the code under an apply and explain approach, while the Commission plans to extend the framework to other listed companies in later phases. The code aligns sustainability reporting with IFRS S1 and IFRS S2 and establishes broader governance, risk management and disclosure requirements around sustainability and climate related risks and opportunities. The framework requires ASE20 companies to issue a separate annual sustainability report containing IFRS S1 and IFRS S2 information, with the first reporting under the mandatory regime due in 2028. Governance requirements include at least one woman on the board, at least one board member with sustainability and climate risk expertise and at least one third independent directors. Companies must also establish board committee arrangements covering governance, sustainability, audit, risk, and nominations and remuneration, while integrating sustainability into internal controls, risk management, compliance, executive responsibilities and remuneration frameworks. Transitional relief is available in the first reporting period, including exemptions from comparative information and, where used, the option to focus initially on climate related disclosures, as well as relief for Scope 3 greenhouse gas emissions under IFRS S2. The code also allows the first year sustainability report to include an assessment plan for achieving full IFRS S1 and IFRS S2 compliance, while other issuers may adopt the framework voluntarily ahead of any later mandatory expansion.

The Central Bank of Kenya (CBK) is consulting on revised Prudential Guidelines, Risk Management Guidelines and Guidance Notes, alongside a framework that would impose additional capital buffers and closer supervision on domestic systemically important banks (D-SIBs). The risk management draft would apply to all institutions licensed under the Banking Act, using an enterprise risk management approach and the Three Lines of Defense model. It specifies minimum Liquidity Coverage Ratio and Net Stable Funding Ratio levels of 100%. Operational risk capital would be calculated under the Basel III Standardized Approach. Institutions would establish disruption tolerances for critical operations and test their ability to withstand severe but plausible scenarios. They would also independently validate material models, maintain exit plans for material third party arrangements and incorporate material environmental, social and governance risks into internal capital and liquidity adequacy assessments. The D-SIB framework would use indicators of systemic importance and supervisory judgment to identify systemic banks. Annual assessments would allocate designated banks to three capital buckets, requiring additional Common Equity Tier 1 capital of 0.5%, 1.5% or 2.5% of risk weighted assets. These buffers would apply at both standalone and consolidated levels, in addition to minimum capital requirements and the capital conservation buffer. Designated banks would conduct quarterly stress tests and at least annual internal capital and liquidity adequacy assessments. Recovery and resolution plans would be updated and submitted to CBK annually by April 30. Newly designated banks and those moving to higher capital buckets would have up to 12 months after notification to comply, with action plans approved by the board required within three months.

The UAE Ministerial Council for Artificial Intelligence and Development reviewed the strategy and second phase of the Agentic AI Project, including a unified national framework for expanding Agentic AI across federal government work. The project advances the government framework announced earlier in 2026 to deploy Agentic AI across 50% of government sectors, services and operations within two years. Key initiatives include FedAI, a national technical ecosystem designed to enable federal entities to develop, adopt and operate Agentic AI solutions within a flexible and secure environment, as well as a customer experience lab and internal government challenges to engage employees in developing solutions. The Council also reviewed results from the first phase, which focused on building government capabilities, assessing services, operations and tasks, and setting priorities. Projects submitted by ministries and federal entities will be launched using Agentic AI in the coming phase

The Dubai Financial Services Authority (DFSA), Hong Kong Monetary Authority (HKMA), Nasdaq Dubai and Hong Kong Exchanges and Clearing Limited have established a Strategic Working Group to deepen cooperation and market connectivity between the Dubai International Financial Centre and Hong Kong. The group will explore joint initiatives in sustainable finance, Islamic finance, innovation and broader capital markets development. Operating under signed terms of reference, the group will provide a formal mechanism for the regulators and exchanges to align priorities, exchange market insights and identify practical opportunities linking issuers and investors across the Middle East and Asia. The initiative builds on their existing regulatory and market dialogue and was announced at the third Hong Kong Monetary Authority and Dubai Financial Services Authority Joint Climate Finance Conference.

The Ghana Securities and Exchange Commission has launched a consultation on draft guidelines establishing a regulatory framework for securities lending and borrowing and short selling. The framework would apply to transactions conducted on an exchange or approved trading system and sets requirements covering eligible securities and participants, approved contractual arrangements, risk management and operational controls, collateral, settlement, record keeping and reporting. Securities lending and borrowing transactions would generally require collateral of at least 100% of the value of the loaned securities, with daily revaluation and corresponding collateral adjustments. For short selling, the draft would permit covered transactions where the seller has borrowed, arranged to borrow or otherwise has a documented basis to expect timely delivery of the securities. Short sales would generally be limited to Government of Ghana benchmark bonds and exchange traded shares with a designated market maker, and could be undertaken by licensed market makers, primary dealers and other persons approved by the Commission. Net short positions in shares would trigger notification to the Commission at 0.1% of issued share capital and each 0.1% increment above that level, while positions of 0.5% and above would also require public disclosure. Net short positions in Government of Ghana bonds would require notification at 0.5% of the relevant issue. The Commission could also suspend or impose conditions on short selling in response to significant price falls, restrictions imposed in other jurisdictions or concerns over market stability or orderly trading.

Madagascar's Ministry of Economy and Finance announced that the country has assumed the presidency of the Eastern and Southern Africa Anti-Money Laundering Group (ESAAMLG) from Rwanda for September 2026 through August 2027. Its priorities are to lead the third mutual evaluation cycle, intensify action against illicit financial flows linked to natural resources and environmental crime, establish a statistical management system and strengthen risk based supervision with a focus on virtual asset service provider compliance. Minister of Economy and Finance Ramiarison Herinjatovo Aimé has become chair of the ESAAMLG Council of Ministers, while the director general of SAMIFIN has assumed the chair of its Task Force of Senior Officials. Madagascar will host the next ESAAMLG Council of Ministers meeting in August 2027.

The Canadian Securities Administrators published a report concluding that data portability could reduce duplication in Know Your Client processes and make it easier for investors to switch providers or open accounts with multiple firms. However, CSA staff decided not to proceed with a planned live testing phase at this time, reflecting stakeholder preference to first see the development and implementation of the federal consumer-driven banking framework, which is expected to establish foundational data-sharing standards relevant to investment firms. Stakeholders broadly supported greater data portability but identified regulatory uncertainty, privacy and security risks, consent management and a lack of common data standards as key barriers. In particular, firms sought clarity on how existing Know Your Client requirements concerning delegation and meaningful client interaction would apply when third-party portability providers are used. There was no consensus on a preferred implementation model, although stakeholders generally viewed governance, security, consent management, interoperability and accountability as central considerations and favoured limiting mandatory portability to raw factual client data rather than proprietary assessments or derived analytics. CSA staff will monitor the federal framework and industry standards, while the project findings may inform future rulemaking, guidance, policy and supervisory work.

The Office of the Superintendent of Financial Institutions has published the final Guideline B-12 on interest rate risk in the banking book, updating the prescribed interest rate shock scenarios and clarifying expectations for earnings-based measures in line with the Basel Committee on Banking Supervision's 2024 targeted amendments. The guideline applies to banks, bank holding companies and federally regulated trust and loan companies. It requires institutions to assess interest rate risk using both economic value and earnings-based measures, with a constant balance sheet approach as the minimum expectation for earnings sensitivity. The revised framework retains six prescribed shock scenarios for economic value of equity and two for net interest income, with Canadian dollar shocks of 200 basis points for the parallel scenario, 275 basis points for the short-term scenario and 175 basis points for the long-term scenario. OSFI has also removed detailed public disclosure requirements from Guideline B-12 and instead refers institutions to its Pillar 3 disclosure framework. The guideline takes effect on November 1, 2026 for institutions with an October 31 fiscal year-end and January 1, 2027 for institutions with a December 31 fiscal year-end. OSFI plans to finalize the related Pillar 3 amendment for interest rate risk on November 19, 2026.

The Federal Deposit Insurance Corporation, Federal Reserve Board, National Credit Union Administration and Office of the Comptroller of the Currency are consulting on revised third-party risk management guidance for banks and insured credit unions. The nonbinding proposal would replace the 2023 interagency guidance and related supplemental resources and is designed to address concerns that the existing framework has been applied too broadly and prescriptively. It would anchor third-party risk management in the risks of each relationship, with practices tailored to the institution’s size, complexity and risk profile and to the nature of the third-party arrangement. The proposed framework covers four areas: risk identification and assessment, risk oversight, residual risk acceptance and governance. Risk assessments would consider both the magnitude and likelihood of harm, while due diligence, contract negotiations and ongoing monitoring would be proportionate to the risks presented by the relationship. The proposal does not prescribe generally applicable contract terms, including for higher-risk relationships, and departure from the guidance or its examples would not, by itself, provide a basis for supervisory action. Institutions could also accept residual risks that remain after mitigation where those risks fall within their risk appetite and tolerances and the institution continues to operate in a safe and sound manner. Separately, the FDIC, Federal Reserve Board and OCC issued a statement on community banks’ relationships with core service providers. In allocating supervisory resources to core providers, the agencies will consider provider transparency, contract practices and technology capabilities, including access to due diligence information, pricing and billing practices, deconversion fees, restrictions on integrating alternative providers, security incidents, management of end-of-support and end-of-life assets, and operational resilience. The agencies may also determine that certain core providers qualify as institution-affiliated parties under the Federal Deposit Insurance Act and may bring appropriate actions where providers engage in, or cause a community bank to engage in, unsafe or unsound practices or violations of law. Community banks remain responsible for safe and sound operations and legal compliance where activities are outsourced.

The New York State Department of Financial Services issued guidance clarifying how regulated entities should conduct and use cybersecurity risk assessments required under the DFS Cybersecurity Regulation, known as Part 500. The guidance creates no new obligations but reinforces that assessments must be sufficiently detailed to inform the design and operation of cybersecurity programs, reviewed and updated at least annually and whenever changes in the business or technology materially alter cyber risk. DFS expects entities to demonstrate how identified risks inform control selection, compensating controls and risk acceptance, with assessments tailored to each entity’s size, complexity, operations and risk profile. The guidance focuses on governance and oversight, a defined and repeatable methodology, comprehensive scope, documentation and traceability, and integration of assessments into the broader cybersecurity program. Assessments should draw on relevant threat intelligence, incident trends, vulnerability testing and other available inputs and cover assets and data flows, emerging technologies and threats, third-party and supply chain exposures, and cyber interdependencies and concentration risk, including potential single points of failure. Entities should maintain documentation linking identified risks to controls, remediation or risk acceptance decisions and use mechanisms such as risk registers to track remediation and changes in residual risk over time. DFS said examinations and investigations have identified recurring weaknesses including incomplete asset coverage, inconsistent risk methodologies, insufficient treatment of evolving and interconnected risks, weak governance and failures to show how assessments influence cybersecurity policies, controls and resource decisions. Risk assessments must remain responsive to material changes, which can include major system migrations, mergers and acquisitions, significant outsourcing arrangements, developments in cybersecurity technologies and the adoption of emerging technologies.

The Federal Deposit Insurance Corporation, Board of Governors of the Federal Reserve System and Office of the Comptroller of the Currency jointly issued an interim final rule expanding eligibility for an 18-month on-site examination cycle. Implementing the 21st Century ROAD to Housing Act, the rule doubles the total asset threshold from USD 3 billion to less than USD 6 billion for qualifying insured depository institutions and makes parallel changes for U.S. branches and agencies of foreign banks. Eligible institutions must satisfy existing capital, management and supervisory criteria, including being well capitalized and well managed, holding an outstanding or good composite rating, having no applicable formal enforcement action and meeting change-in-control restrictions. The agencies estimate that about 188 additional institutions, including approximately 19 U.S. branches and agencies of foreign banks, may qualify, bringing the total to 4,016. Off-site monitoring will continue, and regulators retain authority to conduct more frequent examinations where necessary. The rule will take effect immediately upon publication in the Federal Register.

The U.S. Department of the Treasury’s Financial Crimes Enforcement Network, jointly with staff from the federal banking and credit union regulators, issued guidance clarifying how banks and credit unions may use state-issued mobile driver’s licenses and other government-issued verifiable digital credentials to verify natural person customers under the Customer Identification Program Rule. Institutions may choose to use these credentials where their Customer Identification Programs permit it and the applicable verification requirements are met. For documentary verification, an unexpired government-issued verifiable digital credential may qualify as government-issued identification if it evidences nationality or residence and bears a photograph or similar safeguard. The institution must also have the technology or systems needed to extract the relevant information from the credential. Banks and credit unions may generally rely on qualifying government-issued verifiable digital credentials in the same way as other forms of government identification, while remaining responsible for considering any indications of fraud when determining whether they have a reasonable belief that they know the customer’s true identity. The agencies also updated an existing FAQ on the use of electronic credentials for non-documentary verification. Where such credentials are issued and maintained by a non-government third party, the institution must ensure that the third party applies the same level of authentication the institution itself would use. The FAQs clarify how existing Customer Identification Program requirements apply to these credentials without changing Bank Secrecy Act requirements or establishing new supervisory expectations.