Global Regulator & Central Bank News Roundup

Brazil’s Securities and Exchange Commission (CVM) has set up a pilot program, effective immediately, that lets market participants test securities on distributed ledger technology (DLT) networks. The DLT CVM Pilot Program covers the full securities lifecycle, from issuance and trading to custody and settlement, and applies to any type of security, including shares, debentures, receivables certificates and investment fund units. It is the first deliverable of the CVM’s Tokenization Working Group (GTT). The group brings together CVM staff, industry associations, self-regulatory organizations and specialists, and is tasked with proposing an experimental regulatory regime for tokenized securities. The program will assess whether using DLT for securities is technically, operationally and legally feasible. It will also test interoperability and connectivity between network participants and identify risks and regulatory gaps. A Management Committee made up of the CVM members of the GTT supervises the tests. Its final evaluation for the CVM Board will set out results, risks and recommendations on any regulatory or legislative changes. The GTT continues separate work on infrastructure and cybersecurity, governance and market supervision. José Alexandre Vasco, Sectional Superintendent of Development and Institutional Modernization and GTT coordinator, said the aim is to prepare a safe transition from the experimental regime to a permanent one.”

Argentina's National Securities Commission (CNV) has revised its rules for virtual asset service providers (VASPs), drawing on experience since the regime took effect. The changes set procedures for changing registration categories and leaving the registry. They also codify corporate and capital requirements that had been issued as interpretative guidance. A detailed instruction manual standardizes monthly reporting. The revision continues the CNV's deregulation and simplification drive and builds on the VASP registry created in 2024 and the comprehensive framework adopted in 2025. VASPs changing their declared categories must notify the CNV in advance and prove they meet the relevant requirements before disclosing the change as a material event. Firms leaving the registry must first give clients at least 30 calendar days' notice and enable them to withdraw or transfer their balances. They must then confirm in a sworn statement that they have ceased covered activities. Domestic companies must state VASP activity expressly in their corporate purpose, as generic or ambiguous wording is not accepted. Share capital must be fully paid in and registered. Irrevocable contributions must be capitalized before a firm applies and, once it is registered, within six months of acceptance. Foreign branches must hold assigned capital in Argentina at least equal to the minimum net worth. Permanent representations that cannot assign capital must instead set aside local assets of equivalent value through a guarantee trust. Monthly reports, due within 15 calendar days of the end of each month, cover client numbers, trading volume, at least the 10 most traded virtual assets and custody holdings. Active clients are those with at least one transaction or holding in the previous 12 months. Volume is reported gross and counted once per transaction. It covers only client trades, including contracts such as perpetuals at notional value. In the detail on traded assets, trades between virtual assets are split into both legs. Custody holdings are reported per asset and network at the closing price for the month. Filing is required even in months without activity. The changes take effect the day after their publication in the Official Gazette, and the monthly reporting requirements apply from November 1, 2026.

The Central Bank of the Dominican Republic has published a comprehensive overhaul of the Regulation on the Protection of Users of Financial Products and Services, replacing the framework in place since 2006. The revised rules expand conduct obligations across the product lifecycle, from design and marketing to contracting, cancellation and complaint handling. They also make entities responsible for third parties acting on their behalf. The rules apply to banks and other financial intermediaries, exchange and remittance agents, credit information companies and fiduciary companies linked to financial intermediaries. The overhaul follows a 2022 World Bank assessment that identified scope to improve implementation of the existing framework. Entities must assess product suitability throughout the customer relationship, document those assessments and monitor borrowers' repayment capacity to prevent excessive indebtedness. Fees and charges must reflect a service the user requested and a real, demonstrable cost. All fees must be reported with their justification to the Central Bank and the Superintendency of Banks, and charges that do not match the regulation's definitions will not be recognized. Selling user data for commercial purposes requires express consent. Products may not be advertised as free where any fee could be passed on. Users are entitled to a reflection period of at least 24 hours before signing and a withdrawal right of up to 10 calendar days without penalty. They may also cancel through the same channels used for contracting. Entities must resolve complaints within 30 calendar days, extendable to 45 days in complex cases. Users can escalate unresolved cases to the Superintendency's Office of User Services and Protection, whose decisions are binding. The burden of proof rests with the entity. Users bear losses from unauthorized or fraudulent transactions only where the entity proves user fraud or intentional or negligent breach.

The Eastern Caribbean Central Bank (ECCB) announced that its Office of Financial Conduct has begun accepting complaints on Oct. 15, 2026, from customers of licensed financial institutions regulated by the central bank across the Eastern Caribbean Currency Union. The service is free, and consumers don't need legal representation. Customers may complain about matters including unfair treatment, misleading or incomplete information, fees and charges, banking products and accounts, and access to financial services. The office is responsible for market conduct supervision, including oversight of how licensed financial institutions treat consumers. Its mandate is supported by amendments to the Banking Act, 2015, which have been passed in Antigua and Barbuda, Dominica, Grenada, Montserrat, St. Kitts and Nevis, and St. Vincent and the Grenadines.

The Central Bank of West African States (BCEAO) has opened applications for the first cohort of its Financial Innovation Lab (LIF-BCEAO), a regulatory sandbox that allows financial institutions and FinTech companies to test innovative financial products and services under controlled, real-world conditions. Eligible applicants include licensed financial institutions and FinTech companies, either independently or in partnership with licensed institutions. The sandbox initially covers innovations in payments, fundraising, credit and savings, electronic money and biometric identity verification. Crypto-asset projects are excluded. Applicants will be assessed on innovation and usefulness (30 points), potential impact (30 points), project maturity (20 points), governance (10 points) and the proposed test plan (10 points). They must demonstrate the practical value of their solutions, appropriate risk management arrangements and operational readiness. Test plans must establish measurable objectives, limits on customer participation and financial exposures, consumer safeguards and exit arrangements. The BCEAO has 90 days to assess applications, and approved participants must sign an agreement setting out their testing conditions and obligations. Testing will normally last three to six months, with justified extensions possible within a two-year limit. Participants may receive temporary regulatory relief but must continue to comply with fundamental requirements concerning anti-money laundering, counter-terrorist and proliferation financing, consumer protection, data confidentiality and cybersecurity. They must also submit interim and final reports covering test outcomes, incidents and corrective measures. Successful testing results in a participation certificate rather than regulatory authorisation, with commercial deployment remaining subject to applicable approvals. Applications must be submitted by November 30, 2026.

Ghana's National Insurance Commission (NIC) has completed an environmental, social and governance (ESG) materiality assessment identifying 15 priority topics to guide its sustainability strategy, enterprise risk register and first public sustainability report, targeted for the end of 2026. Governance issues dominated the findings, with ethics, anti-corruption and integrity ranking first, followed by consumer protection and policyholder rights. The assessment involved 80 internal and external stakeholders who rated 28 ESG topics on a five-point scale. Governance accounted for eight of the 15 material topics and six of the eight highest-ranked issues. Ethics, Anti-Corruption, and Integrity received the highest combined score of 4.43 out of 5, while Consumer Protection and Policyholder Rights ranked highest among external stakeholders. Climate Risks in the Insurance Industry ranked sixth and was the only environmental topic identified as material, reflecting its implications for insurance pricing, insurability and solvency. Internal and external stakeholder rankings were largely aligned. The assessment also forms part of the NIC's programme to voluntarily adopt IPSASB SRS 1, Climate-related Disclosures, in 2026, ahead of the standard's effective date for reporting periods beginning on or after January 1, 2028. While the identified material topics will shape the Commission's sustainability priorities, they do not alter the climate disclosure requirements prescribed by the standard. The NIC plans to reassess its material topics periodically as stakeholder priorities evolve.

Algeria’s Commission for Organization and Supervision of Stock Exchange Operations (COSOB) has adopted the country’s first regulatory framework for classifying green securities. Debt securities admitted to trading on the Premium or Emerging segments of the Algiers Stock Exchange’s debt market may qualify where proceeds are used exclusively to finance or refinance eligible projects, including renewable energy, clean transport, biodiversity protection, circular economy initiatives and climate adaptation. Prospective issuers must prepare a green reference framework setting out the planned use of proceeds, project eligibility and selection criteria, environmental and social risks, and arrangements for managing and tracking allocated and unallocated funds. Issuers must also report periodically on allocations. The green reference framework and the use of proceeds are subject to independent external review, such as an external expert opinion, certification or green rating, by a verifier registered with the authority.

Saudi Arabia's Capital Market Authority (CMA) has launched a consultation on amendments to the Investment Funds Regulations and Real Estate Investment Funds Regulations to expand disclosure requirements and consolidate continuing obligations into dedicated regulatory sections. The proposals would strengthen reporting on fund performance, investments, distributions and conflicts of interest, establish the Exchange's website as the mandatory minimum disclosure channel, and lower the disclosure threshold for certain asset transactions by closed-ended investment traded funds and real estate investment traded funds from 10% to 5% of net assets. Annual reports would include more detailed assessments of fund performance against benchmarks, factors affecting returns, future expectations and risk assessments for public funds. Quarterly investment fund statements would identify the 10 largest investments by asset type, counterparty and percentage of net assets, while distribution disclosures would distinguish investment income from capital gains on asset sales. Real estate fund reports would provide additional information on individual property revenues, sector allocations and remaining lease terms. Private fund reporting would also include more detailed information on real estate holdings and private equity and venture capital investments. The proposals would also strengthen conflict-of-interest disclosures in fund terms and conditions and reports, including details of approved conflicts, parties involved, potential impacts, actions taken and fund manager declarations of compliance with conflict management procedures. The reduced 5% transaction reporting threshold would apply to asset purchases, sales, mortgages and leases by the specified traded funds, while separate disclosure triggers for changes of 10% or more in net assets or gross profit would be removed. Fund managers could publish disclosures on additional websites alongside the Exchange's website.

The Hong Kong Monetary Authority (HKMA) has introduced the “ART” Framework, built on the three pillars of Accountability, Resilience and Trust, to govern how banks adopt artificial intelligence responsibly under its Fintech 2030 strategy. In a circular to all authorized institutions, the HKMA issued updated Supervisory Guidance for Responsible Adoption of Artificial Intelligence, which supersedes the High-level Principles on Artificial Intelligence of 1 November 2019, together with a report on practical insights from the second cohort of the Generative AI Sandbox and a Concept Note on the Governance of Agentic AI. The framework also includes an AI training data sharing platform to be developed with Hong Kong Cyberport Management Company Limited and the University of Hong Kong, and further testing of agentic applications through the GenAI Sandbox++. The Guidance, which draws on the Sandbox and the Financial Stability Board's report on Sound Practices for Responsible Adoption of Artificial Intelligence, sets nine expectations to be applied proportionately. Boards must approve an A.I. strategy and risk appetite, each deployed use case must have a designated “owner”, and institutions must keep an inventory of approved use cases and control “shadow AI” Human oversight may now move from the “human-in-the-loop” approach prescribed for customer-facing GenAI in August 2024 to “human-on-the-loop” or “human-in-command” arrangements, depending on the nature and risks of a use case. Testing, validation and approval must match a use case's materiality and risk, with material or higher risk use cases requiring senior management sign-off, independent validation and a built-in kill switch or equivalent. Institutions remain responsible for outcomes delivered through external AI providers, must contractually bar providers from re-using customer data for model training without authorisation, and must inform consumers of AI use and the relevant risks before providing a service powered by AI. The Concept Note, which does not constitute supervisory requirements at this stage, responds to agentic systems that plan and execute multi-step tasks and featured in more than 60% of the second cohort's 27 use cases. It proposes “intent-anchored accountability”, placing responsibility for an agent with the business function behind its intent, and visibility over material agents through institutional inventories and a possible industry-level registry. It also calls for intervention points and emergency stops before actions with material customer implications, and for defined operating boundaries on the tools, systems and data agents may access. The HKMA will shortly issue a discussion paper setting out options for possible supervisory requirements on agentic AI governance.

The Monetary Authority of Singapore (MAS) has announced enhanced safeguards following a consultation on how financial institutions market and distribute financial products and services to retail customers in public places and through telemarketing. The public prospecting measures cover activities outside institutions’ premises, such as roadshows at shopping malls, where consumers may face unsolicited or persistent solicitation. Representatives will need to disclose their marketing purpose and obtain consent before engagement, while institutions will face tighter expectations on where these activities take place and how they supervise conduct. Public prospecting will be limited to commercial premises, with marketing and distribution activities restricted to within a 5-metre radius of the demarcated event space. MAS will not proceed with the proposed minimum event space of 25 square metres. Institutions will instead be required to establish policies and procedures to determine the amount of space needed to provide a conducive setting for marketing and distribution events. Institutions must appoint Public Prospecting Management Officers of sufficient seniority and with good compliance track records to oversee representatives’ conduct at such events, although these officers need not be employees. Street canvassing and door-to-door prospecting will remain prohibited. The requirement to disclose the marketing purpose and obtain consent will also apply to telemarketing calls made without prior appointment, with consent obtained afresh for each call. In response to consultation feedback, MAS scaled back several other proposals. Instead of banning any mention of gifts, it will require institutions to establish a governance framework approved by senior management for offering gifts, including in telemarketing. Plans to bar sales at the initial engagement and to lengthen the periods in which customers can cancel purchases without penalty, currently 14 days for life policies and 7 days for collective investment schemes, were also dropped, as MAS considers these periods adequate. MAS will issue the updated Guidelines on Standards of Conduct for Marketing and Distribution Activities in 2027 and then consult on new Notice(s) making the safeguards legally binding for investment products and long-term accident and health policies. Institutions will have a nine-month transition period to implement the changes.

The Australian Prudential Regulation Authority (APRA) and the Reserve Bank of New Zealand (RBNZ) have completed the 2026 Trans-Tasman Stress Test, their first joint bank stress test since 2017. It covered New Zealand's four largest banks and their Australian parent groups. The results indicate both banking systems would remain resilient through a severe downturn in both economies. Despite substantial losses and pressure on capital and liquidity, banks continued to lend to households and businesses. The scenario combined escalating regional geopolitical tensions, a sharp oil price shock and deep recessions in Australia and New Zealand. It also included a funding shock, market closure and a cyberattack disrupting an offshore banking operation. The four New Zealand banks are subsidiaries of Australia's major banks, so the common scenario allowed the regulators to assess how risks spread across the Tasman. It also let them examine recovery actions and the links between parent banks and their subsidiaries. Detailed RBNZ findings show the New Zealand banks' aggregate Common Equity Tier 1 (CET1) capital ratio falling from 13.2 percent to 8.5 percent before mitigating actions. In this scenario, New Zealand unemployment peaked at 10.5 percent and house prices fell 35 percent. The ratio stayed above the 4.5 percent minimum but fell within prudential buffers, which would trigger dividend restrictions and escalated supervisory monitoring. Loan impairments were the largest source of losses, cutting the ratio by 4.9 percentage points, and residential mortgages accounted for 42 percent of impairment expenses. A 38 percent rise in credit risk-weighted assets removed a further 2.7 percentage points. Mitigating actions, led by tighter lending and parent capital injections, lifted the ratio to 10.6 percent, though capital stayed below its starting level. Parent support beyond reduced dividends could not be assumed when both jurisdictions were under severe stress. APRA will publish detailed findings for Australian banks later in 2026. Additionally, the authorities will consider running joint stress tests more regularly.

The Australian Securities and Investments Commission (ASIC) has launched consultation on licensing guidance and proposed custody, trading and financial requirements for digital asset platforms (DAPs) and tokenised custody platforms (TCPs), ahead of laws commencing April 8, 2027. The package addresses safeguards for client assets, conflicts arising from platform trading activities and financial resources for operators. Existing operators must apply for an Australian financial services (AFS) licence or variation by Oct. 7, 2027, and may continue operating while their applications are assessed. Streamlined licensing is proposed for existing licensees and firms that applied in response to earlier digital asset guidance. Proposed custody standards would require operators to safeguard and segregate client assets, obtain express client authorisation before using them, and report wallet arrangements and addresses to ASIC quarterly. Domestic custody would not be mandatory. Trading standards would require operators executing client orders on other venues to take reasonable steps to obtain the best client outcome and maintain at least two adequate liquidity sources, subject to specified exemptions. Operators matching orders would face restrictions on principal trading on their own or related platforms, with exceptions for specified business models. Covered DAPs could not accept benefits for preferring particular tokens. Platforms would also need controls against trading misconduct and would have to notify ASIC when suspending or terminating client access for suspected misconduct. Financial proposals would require platform operators to prepare quarterly cashflow projections covering at least 12 months and obtain audits addressing compliance with cash needs and net tangible asset (NTA) requirements. Three alternative NTA models share a concession for qualifying outsourced custody. Outside that concession, Model 1 would require the greater of AUD 14 million or 10% of average revenue. Model 2 would reduce the fixed floor to AUD 7 million for operators holding exclusively assets that are not financial products. Model 3 would use the greatest of AUD 2 million, an amount linked to assets held and 10% of average revenue, plus additions for specified trading activities. A separate proposal would exclude from NTA calculations stablecoins issued, possessed or held by the licensee, associated entities, or persons controlled by or under common control with them. Independently issued stablecoins held by an independent custodian could remain eligible if they meet the relevant definitions. This restriction would extend across all AFS licensees, not only digital asset firms.

The Australian Government is consulting on draft legislation to enable international crypto asset tax reporting, introduce a Domestic Crypto Reporting Regime and expand the Common Reporting Standard (CRS). The draft would provide a framework for implementing the Organisation for Economic Co-operation and Development’s Crypto-Asset Reporting Framework (CARF). Under the proposed implementation, providers would collect information for the 2027 calendar year, with first reports to the Australian Taxation Office and exchanges with foreign tax authorities in 2028. The domestic regime would require providers of registrable virtual asset services to report Australian tax residents’ virtual asset exchanges and transfers, including transfers to and from external wallets. Reports are intended to identify providers and users and record each transaction’s asset, date and time, AUD value and identifier. Quarterly reporting is intended from 1 July 2027, subject to a separate legislative instrument. Otherwise, the reporting period would be a financial year beginning on or after that date. Reports would generally be due 31 days after each reporting period. CRS reporting changes would apply for the 2027 calendar year onwards, extending coverage to certain electronic money products, central bank digital currencies and indirect crypto asset investments. Financial institutions would disclose additional account and controlling person information and generally report all jurisdictions of tax residence rather than rely on treaty tie-breaker rules. The existing penalty of one penalty unit would also cover failures to validate self-certifications or act on changes in circumstances within required deadlines. Certain electronic money products would be excluded where their rolling average value over 90 days does not exceed USD 10,000. Scholarship plans would lose their excluded status and become reportable.

The Reserve Bank of New Zealand (RBNZ) and Financial Markets Authority (FMA) outlined supervisory expectations for managing cyber risks associated with frontier artificial intelligence (AI). Presented by Reserve Bank Assistant Governor for Financial Stability Angus McGregor and Financial Markets Authority Executive Director for Response and Enforcement Louise Unger at an industry roundtable, the expectations build on existing prudential, conduct, cyber and operational resilience obligations. They focus on strengthening foundational cyber controls, governance and oversight, third-party and concentration risk management, and incident preparedness as AI accelerates the discovery and exploitation of vulnerabilities. Regulated entities should maintain effective access and asset management, accelerate risk-based vulnerability identification and remediation, and assess whether manual threat monitoring remains adequate against AI-enabled attacks. Boards and senior management should maintain visibility over AI use and material risks, establish clear accountabilities and risk appetite, and ensure effective oversight. Entities should also assess supplier resilience, AI-related third-party exposures and concentration risks, supported by appropriate controls and contractual incident notification arrangements. Incident preparedness should address AI-enabled fraud and cyberattacks, model failures and supplier outages, with response and recovery arrangements tested against severe but plausible disruption scenarios.

The International Financial Services Centres Authority (IFSCA) issued guidelines for algorithmic trading on IFSC stock exchanges, introducing approval, governance, risk control and audit requirements for market participants. No participant may deploy, offer or facilitate algorithmic trading without prior express approval from the relevant stock exchange and initial conformance testing. Market participants must maintain governance, oversight and risk management arrangements, including for algorithms using artificial intelligence or machine learning. Required controls include price, quantity, order value and automated execution checks, kill switches and system capacity checks, including for orders routed through DMA/SA. Algorithmic orders must carry unique identifiers tracing them to the individual client and specific algorithm. Systems will also be subject to annual audits by eligible auditors, auditor rotation and time-bound corrective action. Stock exchanges must establish the necessary systems within three months of the circular's issuance. Existing algorithmic trading systems must complete conformance testing within the same period.

The Philippines' Securities and Exchange Commission (SEC) has set out market making rules for equity and fixed income securities listed, traded or enrolled on exchanges under its jurisdiction. The framework requires exchange accreditation and minimum unimpaired paid-up capital of PHP 150 million, with quotation obligations tailored to each asset class. Government securities governed by the Bureau of the Treasury's Primary Dealer/Government Securities Eligible Dealer framework are excluded unless the SEC expressly extends coverage in coordination with the bureau. Equity market makers must maintain firm, executable quotes on both sides of the market for exchange-prescribed durations, subject to spread limits and minimum quote sizes calibrated to liquidity or other objective criteria. Fixed income quotes may be firm, indicative or best efforts, as determined by the exchange according to the security and market structure. Market makers must maintain, or have reasonable access to, sufficient inventory, liquidity resources or borrowing arrangements, without having to hold inventory at all times. Fixed income inventory obligations apply on a best-efforts basis where borrowing or repurchase markets are unavailable or insufficiently developed. The framework also requires capital and liquidity safeguards and controls for conflicts arising from additional roles with issuers.

The U.S. Department of the Treasury announced coordinated enforcement actions against Bank of America imposing more than USD 1.21 billion in penalties for widespread anti-money laundering (AML) and sanctions compliance failures. The Financial Crimes Enforcement Network (FinCEN) assessed a USD 1.2 billion penalty, which credits the Office of the Comptroller of the Currency's (OCC) record USD 750 million penalty, while the Office of Foreign Assets Control (OFAC) reached a USD 11.6 million settlement covering 475 apparent sanctions violations. Bank of America admitted to willful violations of the Bank Secrecy Act, including failures in transaction monitoring, customer due diligence, foreign correspondent account due diligence and suspicious activity reporting. These deficiencies resulted in more than USD 5 billion in suspicious transactions not being reported on time, including over USD 1 billion involving priority illicit finance and national security risks. The bank relied extensively on external referrals rather than its own controls to identify suspicious activity and failed to address known monitoring deficiencies. The OCC found that these weaknesses prevented effective monitoring of trillions of dollars in transactions and persisted despite a December 2024 cease-and-desist order. FinCEN has required a third-party review to identify and report previously undetected suspicious transactions, alongside independent assessments of the bank's transaction monitoring, due diligence programs and AML data governance. The OFAC settlement concerns apparent sanctions violations arising from payments routed through blocked banks, inadequate sanctions alert calibration, delayed watchlist updates and mishandling of accounts associated with blocked persons. These failures resulted in millions of dollars in transactions involving sanctions programs targeting Russia, Belarus, Iran and other jurisdictions and activities. As part of the settlement, Bank of America committed to compliance measures covering training, testing, audit and future cooperation with OFAC.

The US Office of the Comptroller of the Currency (OCC) has released the findings of its review of debanking at the nine largest national banks it supervises. All nine maintained policies between 2020 and September 2025 that required, encouraged or otherwise influenced them to deny or limit financial services because of customers’ political or religious beliefs or lawful business activities. The review, launched in September 2025 under Executive Order 14331, covered JPMorgan Chase Bank, Bank of America, Citibank, Wells Fargo Bank, U.S. Bank, Capital One, PNC Bank, TD Bank and BMO Bank. Preliminary findings in December 2025 centered on industry restrictions. The report now adds that subjective reputation risk policies disadvantaged customers holding certain political, religious or social views. Drawing on nearly 100,000 complaints and about 420,000 pages of bank documents, the report shows employees escalating customers with views outside a perceived mainstream, often citing negative news or advocacy groups such as the Southern Poverty Law Center. JPMorgan’s subsidiary WePay closed accounts of merchants selling Trump and conservative merchandise. Until 2025, a Capital One business line turned away partisan organizations on both sides of the political spectrum. Ordinary customers lost accounts over unverified allegations or poor reviews, yet some banks retained wealthy clients facing more serious negative media. Industry restrictions, covering sectors from fossil fuels and firearms to detention facilities, tobacco and digital assets, fell hardest on smaller firms. All nine banks have since revised their fair access policies, but reputation risk remains a factor at many, sometimes rebranded as franchise or brand risk. The OCC cannot say with confidence that these reforms will prevent a recurrence. No bank has fully and publicly acknowledged its past debanking decisions. The OCC, which in April 2026 barred its examiners from criticizing banks over reputation risk, is considering further rulemaking to prevent discrimination based on political or religious beliefs and to curb banks’ own reliance on reputation risk. In response to the report, the Consumer Financial Protection Bureau will investigate whether the banks complied with federal consumer financial laws.

The European Banking Authority (EBA) has classified USDC, issued in the European Union by Circle Internet Financial Europe SAS, as a significant e-money token under the Markets in Crypto Assets Regulation. USDC is the first of the 45 e-money tokens notified under the regulation to receive this classification. From Nov. 12, 2026, USDC will be subject to dual supervision by the EBA and France’s Prudential Supervision and Resolution Authority (ACPR). The EBA will assume direct responsibility for own funds, asset reserves, liquidity requirements, and recovery and redemption plans. The ACPR will retain oversight of governance, qualifying holdings, fit and proper assessments, outsourcing and conflicts of interest. The EBA has also signed a memorandum of understanding with the New York State Department of Financial Services to support cooperation and information exchange concerning USDC’s cross-border activities. USDC is issued in the United States by Circle Internet Financial LLC.

The European Securities and Markets Authority (ESMA) has finalised revised guidelines clarifying when issuers may delay public disclosure of inside information under the Market Abuse Regulation (MAR). Issuers generally must disclose inside information directly concerning them as soon as possible, but may delay where immediate disclosure would prejudice their legitimate interests. The revision adds five legitimate interests to an indicative list, clarifies the existing financial distress ground and removes guidance superseded by the Listing Act reforms. Issuers must assess each delay individually, maintain confidentiality and ensure that the information withheld does not contradict their latest public communication on the same matter. The new grounds cover legally grounded confidentiality orders from public authorities, including those outside the European Union, and gathering essential information after exceptional events such as cyberattacks. For incidents, disclosure should occur once a rough estimate of damage is possible, without waiting for detailed analysis or remediation. Protecting commercially sensitive information may justify delay where disclosure directly threatens an identifiable, concrete business opportunity. A formal appointment to a governing body or key role may also qualify where disclosure could jeopardise the appointment before the appointee has notified their current employer of their intended departure. Within a corporate group, delay may be justified where the information directly concerns both entities and disclosure would directly prejudice the issuer and undermine another group company’s lawful delay. The retained financial distress ground is limited to serious and imminent cases outside insolvency proceedings, where immediate disclosure would jeopardise measures the issuer is actively pursuing to restore capital and liquidity. Deteriorating performance or profit warnings alone do not qualify. Examples concerning intermediate steps in protracted processes have been removed because reforms applying since 5 June 2026 generally require disclosure only when those processes reach their final event or circumstance. The former guidance on delays likely to mislead the public has also been deleted following replacement of that statutory condition.

The European Securities and Markets Authority (ESMA) has finalised revised guidelines on standardised procedures and messaging protocols between investment firms and professional clients, completing the regulatory framework for the European Union's transition to a one-day securities settlement cycle (T+1) on 11 October 2027. The guidelines clarify the requirements for exchanging allocations and confirmations under the amended regulatory technical standards (RTS) on Settlement Discipline, which will apply from 7 December 2026. The changes aim to accelerate the exchange of settlement information, increase automation and reduce settlement failures ahead of the shorter settlement cycle. Under the revised framework, investment firms must ensure that professional clients use electronic standardised communication methods, with information structured in a machine-readable format, alongside international open communication procedures and standards for messaging and reference data. The option to use internal or domestic messaging standards has been removed. ESMA has retained flexibility over communication channels, allowing emails and graphical user interfaces, including those involving manual data entry, provided the resulting information can be automatically processed. However, clients conducting frequent or high-volume transactions are expected to minimise manual intervention. Non-electronic communication methods, including faxes and recorded telephone calls, are permitted only under agreed contingency arrangements during documented temporary technical disruptions or service interruptions. The guidelines also clarify that arrangements between investment firms and professional clients may be documented in any legally binding form, allowing firms to rely on existing agreements where appropriate. Parties retain discretion to determine the consequences of delayed, missing or incorrectly formatted communications. Separately, the amended RTS will require written allocations to include the place of settlement and additional transaction details aligned with settlement instruction matching fields from 7 December 2026.

The Joint Committee of the European Supervisory Authorities (ESAs) published its 2027 work programme, prioritising digital operational resilience, consumer protection, sustainable finance, securitisation and cross-sectoral risk monitoring. The programme also covers supervision of financial conglomerates and emerging financial technologies, with an emphasis on supervisory convergence, regulatory simplification and reducing unnecessary reporting burdens. Under the Digital Operational Resilience Act (DORA), the European Supervisory Authorities will update the list of critical ICT third-party service providers, conduct oversight examinations, follow up on recommendations issued in 2026 and publish an annual report on major ICT incidents. They will also test crisis coordination arrangements under the pan-European Systemic Cyber Incident Coordination Framework and support the European Commission's potential legislative review of DORA. In consumer protection, planned technical standards under the proposed Retail Investment Strategy will focus on simplifying the performance and cost disclosures in key information documents for packaged retail and insurance-based investment products, subject to legislative developments. Sustainable finance work will focus on monitoring the review of the Sustainable Finance Disclosure Regulation and promoting consistent application of existing requirements. In securitisation, the authorities will advance preparatory work on revised transparency reporting requirements, strengthen supervisory convergence and monitor non-bank financial institutions' participation and potential regulatory divergence with the United States and United Kingdom. For financial conglomerates, a consultation on capital adequacy reporting templates is planned for the first quarter of 2027, with finalisation of the technical standard targeted by year-end, alongside an assessment of gaps in conglomerate stress testing. Financial innovation work will focus on artificial intelligence and tokenisation, coordination between financial and AI regulatory sandboxes, and further data collection on BigTechs and mixed activity groups providing financial services. The authorities will also continue publishing twice-yearly assessments of cross-sectoral financial stability risks.

Sweden's Riksbank has written to the Riksdag's Committee on Finance arguing that developments in the payments market since the 2023 Payments Inquiry, which found no sufficiently strong societal need for a digital krona at the time, now warrant preparing the legislative framework for one. The Riksbank has not taken a position on whether a digital krona should be issued. Its central point is timing: implementation by the central bank and the market would take at least five years, before counting the time needed to amend legislation, so legal preparation should start now even if Sweden later decides against a launch or postpones it. The letter proposes that this work begin with the appointment of a public inquiry. Four developments drive the reassessment. The geopolitical situation has deteriorated, and the payments system, part of Sweden's total defence, is exposed to hybrid threats such as cyber attacks. A digital krona would add a payment method on Swedish and European infrastructure with offline functionality during power or telecommunications outages. The digital euro is also well advanced, with the Council and the European Parliament backing the European Commission's 2023 proposal, trilogues expected to conclude in 2026 and the European Central Bank (ECB) planning a pilot in the second half of 2027 and a public launch in 2029. Future EU payment infrastructure and legislation will assume a digital euro, and the absence of a comparable krona-based solution could erode the competitiveness of Sweden's payment system. Stablecoins, mostly pegged to the US dollar, could put pressure on krona usage if adopted for payments, a risk the Riksbank judges limited in the near term but not negligible over time. Finally, Sweden shows signs of lagging European peers on innovation, notably instant account-to-account payments, which almost all banks in Norway and Denmark offer and euro area banks must provide. On design, the Riksbank favours building on the ECB's digital euro infrastructure, consistent with its use of the TIPS platform and planned move to T2, and a privacy framework modelled on the digital euro, under which the central bank cannot identify payers or payees online, offline payments in shops remain anonymous like cash, and the currency is not programmable. The proposed inquiry would examine amendments to the Sveriges Riksbank Act, a new Act on digital kronor covering availability, distribution, the division of responsibilities between the Riksbank and private actors, and offline use, as well as changes to secrecy, bankruptcy and gift legislation and the interplay with payment services, data protection, anti-money laundering and sanctions rules. Constitutional amendments would fall outside its remit

The UK Prudential Regulation Authority (PRA) and Financial Conduct Authority (FCA) have finalised changes to high loan-to-income (LTI) mortgage lending rules that will remove the 15% cap on individual lenders while maintaining the Financial Policy Committee's (FPC) recommended 15% aggregate limit. The framework allows lenders to exceed the 15% threshold individually, provided their lending strategies are supported by appropriate governance and risk management controls. If aggregate high LTI lending becomes inconsistent with the FPC's limit, the regulators may expect lenders to gradually reduce their high LTI lending towards 15%. High LTI mortgages are defined as those with an LTI ratio of 4.5 or above. The regulators will monitor aggregate high LTI lending on a single-calendar-quarter basis, while measuring individual lenders' high LTI flows and compliance with adjustment expectations over a rolling four-quarter period. This represents a change from the consultation proposals, allowing lenders to manage adjustments more gradually. Where reductions are expected, a uniform proportional adjustment rate will apply to lenders whose high LTI flows exceed 15%, subject to the existing de minimis exemption. The regulators have retained expectations for lenders to monitor aggregate flows, maintain appropriate controls to adjust their lending and notify their regulator when intending to increase high LTI lending above 15%. The framework also explicitly excludes further advances and retirement interest-only mortgages. The PRA will publish quarterly aggregate high LTI lending figures, alongside data on the volume of mortgage completions within the policy's scope relative to total completions, beginning with third-quarter 2026 data in the fourth quarter.

The Swedish Financial Supervisory Authority (FSA) has issued guidancein the form of Q&A on the use of artificial intelligence (AI) in managing environmental, social and governance (ESG) data, clarifying how existing regulatory requirements apply when financial firms use AI to process information. The guidance emphasizes that firms remain responsible for the quality and reliability of ESG data, regardless of whether it is handled manually, through AI or by external providers. The applicable requirements depend on the information's intended use, with particular emphasis on credit institutions' risk management and lending activities. The guidance addresses the challenges AI can create in tracing data sources, understanding processing methods and verifying outputs. The controls needed depend on how AI is used: extracting information calls for attention to traceability and verification, estimating missing data requires scrutiny of methodologies and assumptions, and using AI for risk assessments places greater emphasis on governance and oversight. Data quality must also be assessed against its intended purpose, as information suitable for one application may be insufficient for another. For credit decisions, institutions must ensure that ESG data is sufficient, accurate and current, with documentation that allows decisions and their underlying information to be understood and reviewed. Where ESG data is obtained from external providers, firms remain responsible for assessing the underlying sources, methodologies and limitations rather than relying solely on supplier assurances. Additional requirements apply where the arrangement constitutes outsourcing. The guidance also clarifies that AI systems are not automatically classified as high risk under the EU AI Act merely because they process ESG data, although specific uses may trigger that classification. The guidance is the first output of the authority's Innovationskompassen initiative.