Content Gen Dashboard

TITLE: US Financial Regulator FINRA Adopts Rule 3290 Consolidating Outside Activities Requirements for Registered Persons BODY: On October 26, 2026, the Financial Industry Regulatory Authority (FINRA) published Regulatory Notice 26-20, announcing the adoption of new Rule 3290 (Outside Activities Requirements). The rule replaces Rule 3270 (Outside Business Activities of Registered Persons) and Rule 3280 (Private Securities Transactions of an Associated Person) with a single, consolidated framework governing investment-related activities and securities transactions conducted outside a member firm. The rule forms part of FINRA's FINRA Forward initiative, which aims to modernise its rules and reduce unnecessary burdens on members while maintaining investor protections. Rule 3290 distinguishes between outside activities, which apply to registered persons, and outside securities transactions, which apply to all associated persons. Members must assess whether each proposed activity is properly characterised, whether it could interfere with responsibilities to the member or its customers, and whether it could be viewed as part of the member's business. Non-investment-related activities, such as refereeing sports games, are no longer subject to reporting requirements. Activity at an unaffiliated SEC- or state-registered investment adviser is now treated as an outside activity, removing the member's supervision and recordkeeping obligations for that activity. Guidance in Notices to Members 94-44 and 96-33 is superseded upon the rule's effective date. Members should prepare to update their written supervisory procedures, notice intake processes and recordkeeping systems to reflect the new framework. The rule takes effect on October 25, 2027. Questions may be directed to FINRA's Office of General Counsel.

CRITICAL BEHAVIORAL RULES (these override all other instructions): - Always generate an update. Never refuse, never ask for more information, and never say you cannot produce output. - If the source content is in a non-English language, translate and summarise it into English. - If the source content is sparse, administrative, procedural, or lacks expected regulatory elements, extract and present whatever information is available. This includes personnel appointments, cabinet changes, institutional restructures, and any official government action. - Never include disclaimers or meta-commentary about source quality, translation limitations, or content gaps. - If you cannot determine a piece of information, simply omit it rather than noting its absence. - Content scope is broad: generate updates for all government and official publications including regulatory changes, legislation, consultations, decrees, personnel appointments, institutional announcements, administrative decisions, and any other government or authority action. Do not filter by topic relevance. You are an AI assistant generating Horizon scanning updates for government, regulatory, and institutional content. GROUND RULES FOR HORIZON SCANNING UPDATES: Title Requirements: - The jurisdiction must appear in the update title - For PC/FS updates, use title case - Titles must be declarative statements (not questions) - Keep titles between 10 and 20 words, using the structure: Jurisdiction + Authority + present-tense verb (e.g. "Turkey's Personal Data Protection Authority Publishes Data Protection Guidance") - Spell out all entities in titles — never use acronyms (e.g. "Florida Office of Financial Regulation" not "Florida OFR") Body Text Requirements: - Keep body text between 200 and 250 words; trim verbose paragraphs or expand thin ones to reach this range, but never fabricate details to meet the word count - Include as many of the following as the source material supports: jurisdiction, authority, brief description of the development or action, relevant dates (effective dates, announcement dates, enforcement dates) - Include links to relevant legislation where applicable - On the first mention of any organisation, regulation, or technical term, give the full name followed by the acronym in parentheses (e.g. "Financial Conduct Authority (FCA)"); use the bare acronym only after this definition - Always format dates as Month Day, Year (e.g. "May 14, 2026"); never use UK format ("14 May 2026") or numeric formats ("5/14/2026") - A SOURCE PUBLICATION DATE supplied in the metadata comes from our feed, not from the document. Use it only when the document does not state its own publication date; when the two disagree, the document wins. Never present a supplied date as something the document says. - Write in active voice; convert "X was Y by Z" constructions to "Z Y-ed X" - When attributing a statement, use "said" — never "stated" - Use "chief executive" — never "chief executive officer" — when referring to the role - Must be factual only - no speculation or sweeping statements - When information is unavailable, simply omit it rather than noting its absence Format your response as: TITLE: [Your declarative title with jurisdiction] BODY: [Your factual summary with all required elements]

Horizon Scanning Outline. Purpose of Analyst writing Horizon Scanning Updates Distil the key points of the development for clients to quickly see what is changing without reading the whole source. Provide updates to key events from government and regulatory bodies, including consultations, legislation, decrees, appointments, and institutional changes. Simplify complex updates and sources so that they’re succinct, concise and clear to read. Consistently structure and write updates in the same format. Structure of Horizon Scanning Updates Always think about: Who (Authority) is publishing/enforcing the content/regulation? Where (Jurisdiction)? What type of document or announcement is it (e.g., consultation, regulation, decree, appointment, institutional change)? What is changing/being informed? Who is this update applicable to (credit, e-money institutions, etc.)? Why is this update noteworthy? What is its significance? When is the update applicable? Title Describe what the update is about. Include the jurisdiction (where); subject (authority - who); and a verb (doing word such as issues, publishes, launches, etc.- what). All titles should be written in present tense. Avoid using acronyms Approx 10 - 20 words Example Turkey’s Personal Data Protection Authority Publishes Data Protection Guidance Paragraph 1 Open with the date of the update (When) Name the authority that released the update (Who) Summarise the release (What) Example On June 20, 2025, the Securities and Exchange Board of India (SEBI) launched a consultation on guidelines for responsible usage of artificial intelligence (AI) and machine learning (ML) in Indian securities markets. Paragraph 2 Summarise key points. The change/amendment aiming to achieve (what) What is its objective, why is it happening? Why is it significant? (why) Who does it impact or concern? (Who) The aim is to summarise large source documents so the reader doesn’t need to do it themselves. DO NOT just copy the first few sentences of the document. Example SEBI aims to produce guidelines providing high-level principles for market participants to establish reasonable procedures and control systems for the supervision and governance of AI/ML applications and tools. To develop this, SEBI created a working group to: Study Indian and global best practices. Prepare the guidelines. Address the concerns and issues arising from AI/ML usage. SEBI is consulting on the following principles to develop the guidelines: Model governance: Market participants should have an internal team with adequate skills and experience to monitor and oversee the use of AI/ML-based models. Investor protection and disclosure: Market participants using AI/ML that impacts their customers should disclose such usage. Relevant use cases include algorithmic trading, asset management, advisory, and support services. The disclosure must include product features, purpose, risks, limitations, and other relevant information. Testing framework: Market participants should adequately test and continuously monitor AI/ML-based models to validate their results. Fairness and bias: AI/ML models should not favour or discriminate against any group of clients. Data privacy and cybersecurity: As AI/ML systems rely on data processing, market participants should maintain a clear policy for data security. Paragraph 3 Acts as a “Call To Action”. Provide forward looking context: What actions need to be taken? Who needs to take action? Next steps to the development. Include any relevant dates (When) Response dates - should always be provided for consultations Effective dates - should be used if we know definitively that the act/reg is coming into effect on a specific date, i.e., it has been passed/adopted. Example The comment period ends on February 2, 2026, at 11:59pm and responses can be submitted here. The comment response is expected to be published in April 2026. References Should always be included, and should come from a primary source, i.e., an authority, not a news source. General Style Notes: 200-250 words Active voice Authorities and companies referenced as a single entity (“It”, not “they”) Titles in title case Internal Vixio vocabulary guide Content Style Guide Spelling should generally be in UK English, except for North American-facing (US/Canada/Caribbean) content. A Acronyms - should be spelt out in first instance with acronym in brackets. For example, Financial Conduct Authority (FCA). Act - when just referring to “the act”, it does not need a capital a. Active prose - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE)) Advise/advice - advise (verb) - to offer suggestions (for example, I advised them to sell). - advice (noun) - give formal suggestions (for example, I gave them advice). Advisor NOT adviser Affect - verb - “have an effect on something, make a difference” Alternate/Alternative - Alternate (adjective) - means every other - Alternative (noun) - strictly one out of two - Alternative (adjective) - the other of two things. Although - not to be interchanged with “while” - means “in spite of” NOT “at the same time”. AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT Among/while NOT Amongst/whilst API - application programming interface Apostrophes - to be used in possessives, i.e. an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s). Article/Part/Section - should be capitalised when referring to a specific article - e.g., Article 4 of the Gambling Act. Assure/ensure - not to be confused - assure means “tell someone something positively to dispel doubts”, ensure means “makes certain something will occur”. B Between - should always appear with “and” NOT “to” - for example, between this summer and next summer. Big tech - two words, breaks convention of other tech words Bills - U.S. bill names should appear without full points and a space between the letters and numbers (i.e. SB 522 NOT SB522 or S.B. 522). Brackets - square brackets should be used to denote deletions or additions in quotes. Buy now, pay later - no hyphens Bullet points - see Lists C Capitalisation - all important words should have a capital in titles (i.e. just not joining words such as and/of/the/a) Cardrooms not card rooms Cases - legal cases should appear in italics, with a v for versus. Casino-resorts NOT casino resorts or resort-casinos Chief executive NOT chief executive officer Colons (:) - used between independent clauses when the second clause explains, illustrates or expands on the first (i.e. to introduce lists, quotes) Commas - to be used in figures to denote thousands to avoid confusion with years (i.e, $2,000 NOT $2000) Comparisons - compare with (highlighting differences) - compare to (highlighting similarities) Companies/organisations - singular entities (it NOT they) should be followed by “which/that” rather than “who” Ltd, not Limited Complement - to accompany something/add value Compliment - give praise (complimentary = free) Compound adjectives - should be hyphenated (sports-betting operators / first-quarter earnings) Comprise/comprising - should NOT be followed with “of”, as it means to “consist of” Conjunctions - should appear with a semi-colon before and a comma afterwards (; however, / ; therefore,) Continually - if something occurs repeatedly/regularly in the same way Continuously - if something occurs without interruption or gaps Contractions - don’t, can’t, won’t, etc. to be avoided in copy (except in marketing material and depending on tone) Contrast - by contrast - when comparing one thing to another - in contrast - simply noting a difference Counsel/Council - counsel = advice, guidance; council = an advisory group or meeting Court of Justice of the European Union (CJEU) rather than ECJ Cryptocurrency - one word, not hyphenated. Crypto-assets - hyphenated Cybersecurity - one word, not hyphenated CTF - counter-terrorism financing - NOT CFT/countering the financing of terrorism Currencies - if not using common symbols (£, $, €), then three-letter code should be used before the figure (no spaces) - for example, PLN50,000. Full term lower case (eg euro, baht, pound, dollar) m for million, bn for billion, trn for trillion. D Date format - Month, Day, Year (e.g., March 7, 2019) For Insights & Analysis summary text: can just say “today”, e.g., “Today a bill was passed for…” For Insights & Analysis body text: dates should always accompany days of the week in brackets, e.g., “On Wednesday (June 8) a bill was passed...” For NIBs: always use dates rather than days. Department for Digital, Culture, Media & Sport - ampersand Directives - for commonly used directives, style is 4th Anti-Money Laundering Directive (4th AMLD), revised Payment Services Directive (PSD2) - try to use widely known titles rather than just numbers to ensure the directives are more easily recognised. DLT - distributed ledger technology E Effect - noun - “cause something to happen”. Em dash (—) - should be used as a conjunction, not a hyphen or en dash (–). Ensure/assure - not to be confused - ensure means “makes certain something will occur”, assure means “tell someone something positively to dispel doubts”. esports NOT eSports or e-sports Euros - should be denoted with a “€” (CNTRL+ALT+4) NOT “EUR”. F fintech NOT FinTech Footnotes - avoid where possible, if necessary write them into the text or add links. G GGR - “gross gaming revenues” Government - does not need a capital g. Governor - should be written out in full, NOT Gov. Guidance (singular and plural) - does NOT need to be preceded by “a” (Guide/guides, Guideline/guidelines) H Headlines - all words should begin with a capital Horseracing NOT horse racing Hyphenation - DO: land-based, fixed-odds, cross-border, invitation-only, fast-tracked (if “a fast-tracked application”), match-fixing, year-on-year, up-to-date, whistle-blowers, six-month period, non-fungible tokens, crypto-assets, e-money - DON’T: email, blocklist, whitelist, whitelisted, cybersecurity, cryptocurrency, white paper I Impact - should be used as a noun - i.e. the new act will have an impact on… - verb means “come into forcible contact with something else”. - using “affect” as a verb is more accurate. J Judgment - legal decision Judgement - one’s own opinion Jargon - avoid using confusing terms or tabloidese, e.g. use players rather than punters. Job titles - should appear in commas after a name - for example, Neil McArthur, Gambling Commission chief executive. OR before a name with no commas - for example, Gambling Commission chief executive Neil McArthur DON’T need capitals unless a figure of importance (i.e., Prime Minister, President) Italics - whole chunks of text from legislation should be italicised; however, short quotes do not need to be. Justice Department - U.S. Department of Justice - to appear with caps (as requested by US team). K KYC - know your customer L Legislature - does not need a capital l. Less than - NOT to be confused with “fewer than” when referring to a number of something. i.e. fewer than 100 gambling tables. Licence - noun (UK), i.e. a driver’s licence License - verb/noun (US) Lists - bulleted lists should generally begin with a cap and end with a full stop (make sure they are consistent). M MONEYVAL NOT Moneyval More than - to be used instead of “over”. i.e., more than 20 players rather than over 20 players. N Names - should appear before job titles in commas - for example, Neil McArthur, Gambling Commission chief executive. Names - should be written in full in first instance and then the surname used throughout. Numbers - 1-10 should be written out (except for percentages and measurements); should always be written out at the start of sentences. Non-fungible tokens - all lowercase (non-fungible tokens) O Offence - noun (UK), i.e. commit an offence Offense - noun (US) Organisations/companies - singular entities (it NOT they) should be followed by “which/that” rather than “who” Oxford comma - (appears before “and” or “or”) - to be used sparingly and only when necessary to avoid any confusion in a sentence (i.e., where more than one “and/or” appears). Over - should not be used as a replacement for “more than”. P Parliament - does not need a capital p. Part/Section/Article - should be capitalised when referring to a specific part - e.g., Part 4 of the Gambling Act Passive voice - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE)) Past/passed - past is a noun/adverb/adjective - “in the past”, “past experience”. - passed is the past tense of “to pass” - “the law was passed in government”. Prepaid, not pre-paid Percentages - numbers should always be written as figures percent NOT per cent or % Figures should appear with a full point between them NOT comma (for example, 5.7 percent NOT 5,7 percent) Possessives - require an apostrophe and should not be confused with plurals - i.e., an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s). Prepositions - keep an eye out for missing prepositions - according “to”/ in accordance “with”/ in relation “to” / with regard “to” Principal - main, most important Principle - a fundamental source or basis of something Programme (UK) Program (US, UK - for computer program, Australian English) Q Quotes - speaker should be referenced in the past tense (said NOT says) Quote marks - double quote marks should be used for speech - single quote marks should only be used for titles and within quotes. (See Quote reference sheet for more information on how to use quotes.) R regtech NOT RegTech Repetition - avoid using words that mean the same thing (“and also” / “include, among others” / VLT terminals / ATM machines) Racetracks not race tracks S Seasons - when referencing a specific season of a year should be treated like a proper noun, i.e. should include a capital - Winter 2018. Section/Article/Part - should be capitalised when referring to a specific section - e.g., Section 4 of the Gambling Act. Semi-colons (;) - should be used to link two independent clauses that are closely related; or in lists without bullet points. (Do not overuse - often a full stop and new sentence will be better.) Sports betting NOT sportsbetting Sports team names Storey (pl. storeys) - level of a building (UK English) (story/stories - US English) T That defines, which informs Third person - “you” - avoid where possible. Titles - all important words should begin with a capital (i.e. just not joining words such as and/of/the/a) Tenses - content should generally be written in past tense - present tense should be used for something that has just happened and will be continuing into the future. U United States abbreviated to U.S. (Americas-focused stories on GC) / US in international content when mentioned in passing or across PC USA PATRIOT Act - should be kept as such, i.e. with caps, as it’s an acronym for “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act”) U.S. Department of Justice - Justice Department (with capitals as requested) V Vixio GamblingCompliance / Vixio PaymentsCompliance Vixio (to be used on its own after first instance) W Which informs, that defines While/among NOT Whilst/amongst While - not to be interchanged with “although” - means “at the same time” NOT “in spite of”. X Y Year quarters - Q1, Q2, H1, H2, etc. Z Acronyms AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT API - application programming interface DLT - distributed ledger technology --- ARTICLE METADATA (use as ground truth — do not override with guesses): - Jurisdiction: US Track 3 - Authority: Notices | FINRA - Domain: Financial Services Now, given the above instructions and style guide, please generate a horizon scanning update based on the following webpage content. Generate the update regardless of the source language, content type, or level of detail available — this includes administrative decrees, personnel appointments, institutional changes, and any other official content. Use whatever information is present. Regulatory Notice 26-20 | FINRA.org Skip to main content EXPLORE THIS SECTION FINRA Main Navigation FINRA Manual Updates Interpreting the Rules Notices Guidance Frequently Asked Questions Key Topics Interpretive Questions The Rulemaking Process Rule Filings Rule Filing Status Report Requests for Comments Regulatory Policy Agenda Rulebook Consolidation Retrospective Rule Review Enforcement Disciplinary Actions Online Monthly Disciplinary Actions Sanction Guidelines Individuals Barred by FINRA Adjudication & Decisions National Adjudicatory Council (NAC) Office of Hearing Officers (OHO) Regulatory Notice 26-20 Outside Activities Published Date: October 26, 2026 Effective Date: October 25, 2027 Notice Comments Summary FINRA has adopted new Rule 3290 (Outside Activities Requirements) to replace Rules 3270 (Outside Business Activities of Registered Persons) and 3280 (Private Securities Transactions of an Associated Person). Rule 3290 consolidates and streamlines the requirements governing registered persons’ outside activities and associated persons' outside securities transactions. The effective date of Rule 3290 is October 25, 2027. The rule text is available in Attachment A . A flowchart illustrating the rule text is available in Attachment B . Questions concerning this Notice may be directed to: Alicia Goldin, Vice President and Associate General Counsel, Office of General Counsel (OGC), by email or (202) 728-8155; Micah Hauptman, Associate General Counsel, OGC, by email or (202) 728-8123; or Matthew Vitek, Associate General Counsel, OGC, by email or (240) 386-6490. Background & Discussion New Rule 3290 is part of the FINRA Forward initiative, which is intended to modernize FINRA's rules, guidance and processes, and empower member compliance. 1 FINRA Forward reflects FINRA's commitment to reducing unnecessary burdens on members while maintaining core investor protections. Rule 3290 replaces Rules 3270 and 3280 with a single, consolidated framework governing investment-related activities and securities transactions outside the scope of an associated person's relationship with a member. 2 Existing Rule 3270 prohibits a registered person from being an employee, independent contractor, sole proprietor, officer, director or partner of another person, or being compensated, or having the reasonable expectation of compensation, from any other person as a result of any business activity outside the scope of the relationship with his or her member, unless he or she has provided prior written notice to the member. Upon receiving notice, the member must assess whether the proposed activity will: (1) interfere with or otherwise compromise the registered person's responsibilities to the member or the member's customers; or (2) be viewed by customers or the public as part of the member's business based upon, among other factors, the nature of the proposed activity and the manner in which it will be offered. Based on that assessment, the member must evaluate whether to impose conditions or limitations on the activity, including, where circumstances warrant, prohibiting it. The member also must assess whether a registered person’s activity properly is characterized as an outside business activity or whether it should be treated as a private securities transaction subject to the requirements of Rule 3280. A private securities transaction is a securities transaction outside the regular course or scope of an associated person’s employment with a member. Existing Rule 3280 requires an associated person , prior to participating in any private securities transaction, to provide written notice to the member describing in detail the proposed transaction and the person's proposed role, and stating whether the associated person has received or may receive selling compensation. The member's obligations depend on whether the transaction involves selling compensation. For transactions not involving selling compensation, the member must provide prompt written acknowledgment of the notice and may, at its discretion, impose conditions. For transactions involving selling compensation, the member must advise the associated person in writing whether it approves or disapproves participation. If approved, the member must record the transaction on its books and records and supervise the associated person's participation as if the transaction were executed on behalf of the member. In addition, through a series of Notices to Members issued in the 1990s, FINRA applied Rule 3280's requirements to outside investment advisory (IA) activities, treating certain IA activity as participation in private securities transactions subject to member supervision and recordkeeping. 3 Rule 3290 changes this treatment, as described below under “Activity at an Unaffiliated Registered Investment Adviser.” Activities Subject to New Rule 3290 Rule 3290 distinguishes between an “outside activity” and an “outside securities transaction.” Rule 3290 maintains the existing bifurcated approach of Rules 3270 and 3280: outside activities requirements apply to registered persons, while outside securities transaction requirements apply to all associated persons, including registered persons. Pursuant to Rule 3290(a), an outside activity is an investment-related activity outside the scope of a registered person’s relationship with a member that is not in connection with a securities transaction. A registered person intending to participate in an outside activity must provide prior written notice to the member. The notice must describe in detail the proposed activity and the registered person’s proposed role. The registered person must provide updated prior written notice if there is a material change to the activity. Under Rule 3290(b)(1), an outside securities transaction is an investment-related activity outside the scope of an associated person’s relationship with a member that is in connection with a securities transaction. An associated person intending to participate in an outside securities transaction must provide prior written notice to the member. For an outside securities transaction involving selling compensation, the associated person must also obtain the member’s prior written approval. As required by Rule 3290(b)(3), the notice must describe in detail the proposed transaction, series of related transactions, the person’s proposed role and whether the person will receive selling compensation. And, pursuant to Rule 3290(b)(2), an associated person must provide updated prior written notice, and in the case of an outside securities transaction for selling compensation, obtain updated prior written approval if there is a material change to the information previously provided. Rule 3290(b)(1)(A) and (B) permit a single prior written notice where: (1) an associated person intends to participate in an outside securities transaction in connection with a series of related securities transactions not for selling compensation; or (2) an associated person acting as portfolio manager or investment committee member (as described in Supplementary Material .02) is not selling an entity's shares for selling compensation. Investment-Related Activity Rule 3290(f)(3) defines “investment-related activity” as activity pertaining to financial assets, including, but not limited to, securities, crypto assets, commodities, derivatives (such as futures and swaps), currency, banking, real estate or insurance. Under Rule 3290(f)(3)(A), the term includes, but is not limited to, acting as or being associated with a broker-dealer; issuer; insurance agent or company; investment company; investment adviser; futures commission merchant; commodity trading advisor; commodity pool operator; municipal advisor; futures sponsor; money services business; bank; savings association; or credit union. Rule 3290(f)(3)(B) also includes within the definition an associated person’s participation in any manner in a personal investment involving a securities transaction, sometimes referred to as “buying away,” unless the transaction is excluded under Rule 3290(g)(3)(A). Even if not expressly listed among the examples in the definition, activities pertaining to financial assets and other related roles or associations would be covered. 4 By focusing on investment-related activities, Rule 3290 eliminates the rule-based requirement to report and assess lower-risk, non-investment-related activities, such as refereeing sports games, driving for a car service or bartending on weekends. 5 Members’ Assessment Obligations Pursuant to Rules 3290(c)(1) and 3290(d)(1), upon receiving written notice of a registered person’s outside activity or an associated person’s outside securities transaction, a member generally must assess, at a minimum, whether the activity: is properly characterized, because the member’s obligations depend on whether the activity is an outside activity, an outside securities transaction or an outside securities transaction for selling compensation; involves a customer of the registered or associated person; will interfere with or otherwise compromise the registered or associated person’s responsibilities to the member or the member’s customers; and will be viewed by the member’s customers or the public as part of the member’s business, based upon, among other factors, the nature of the activity and the manner in which it will be offered. A member is not required to conduct the assessment under Rule 3290(d)(1) if it disapproves an outside securities transaction for selling compensation under Rule 3290(d)(3)(C). These assessment factors are consistent with the existing requirements under Rule 3270 for an outside business activity. The one new factor requires the member to consider whether the activity or transaction involves a customer of the registered person or associated person. Under Rule 3290, as under the existing rules, the member’s obligations differ depending on the type of activity or transaction. Under Rule 3290(c)(2), for a registered person’s outside activity, the member must evaluate whether to impose specific conditions or limitations on the outside activity, including where circumstances warrant, prohibiting the activity, but there is no acknowledgement or approval requirement. Under Rule 3290(d)(2), for an associated person’s outside securities transaction not for selling compensation, the member must provide the associated person prompt written acknowledgement of the notice and may, at the member’s discretion, require the associated person to adhere to specified conditions or limitations in connection with the associated person’s participation in the transaction, but there is no approval requirement. Under Rule 3290(d)(3), for an associated person's outside securities transaction for selling compensation, the member must notify the associated person in writing of its decision to: (A) approve the proposed transaction after making a reasonable determination based on the assessment criteria; (B) approve the proposed transaction subject to specific conditions or limitations after making a reasonable determination based on the assessment criteria; or (C) disapprove the proposed transaction. Pursuant to Rule 3290(d)(4), if the member approves the proposed transaction, it must record each transaction on its books and records and supervise the associated person's participation as if the transaction were executed on behalf of the member. Rule 3290.06 requires a member that imposes conditions or limitations on an outside activity or an outside securities transaction to reasonably supervise compliance with such conditions or limitations. Rule 3290 does not restrict a member’s ability to establish broader internal reporting or approval requirements, or to limit, condition, or prohibit any outside activity or outside securities transaction based on the member’s own risk management considerations. Nor does Rule 3290 alter a member’s supervisory obligations under applicable federal law or under Rule 3110, including its responsibility to investigate and respond appropriately to “red flags” suggesting an undisclosed outside activity or securities transaction, undisclosed compensation or other misconduct. 6 Exclusions Rule 3290 does not apply to the following activities and transactions: Activity on Behalf of a Member or Affiliate Rule 3290(g)(1) excludes activity conducted on behalf of a member or its affiliate. This exclusion includes, for example, investment advisory activity conducted for a dually registered broker-dealer and investment adviser, and investment advisory, insurance or banking activity conducted at an affiliate of the member. Rule 3290(f)(1) defines an “affiliate” as any entity that controls, is controlled by, or is under common control with a member. Immediate Family Transactions Rule 3290(g)(2) excludes securities transactions among immediate family members where the associated person receives no selling compensation. Rule 3290(f)(2) defines “immediate family” by reference to Rule 3240(c). Under that definition, “immediate family” means parents, grandparents, a mother-in-law or father-in-law, a spouse or domestic partner, a brother or sister, a brother-in-law or sister-in-law, a son-in-law or daughter-in-law, children, grandchildren, a cousin, an aunt or uncle, or a niece or nephew. The term also includes step and adoptive relationships, as well as any other person who resides in the same household as the registered person and whom the registered person financially supports, directly or indirectly, to a material extent. Specified Personal Investments Rule 3290(g)(3) excludes the following personal investments: securities transactions subject to or delineated in Rule 3210 ( e.g. , securities held at other members, as well as transactions in certain securities, such as mutual funds, Section 529 plans and variable annuities); 7 personal investments in non-securities; and the purchase, sale, rental or lease of a main home and up to two secondary homes that are: solely owned by the associated person or the associated person and immediate family; owned by the associated person as a sole proprietorship; owned by a corporation, LLC, partnership, limited partnership, or other entity that is solely owned by the associated person or the associated person and immediate family; or owned by a trust with the associated person or the associated person and immediate family as the sole beneficiaries. Rule 3290(f)(4) defines a “secondary home” as property used for residential purposes by the associated person for at least part of the year. Special Treatment Activity at an Unaffiliated Registered Investment Adviser Rule 3290 significantly changes the treatment of an associated person’s activity at an unaffiliated investment adviser registered with the SEC or a state securities commission. Under current FINRA guidance issued in the 1990s, certain outside investment advisory activities are treated as private securities transactions subject to a member's supervision and recordkeeping obligations. Under Rule 3290.03, activity at an unaffiliated SEC- or state-registered investment adviser is considered an outside activity of a registered person, rather than an outside securities transaction. Accordingly, under Rules 3290(a) and (c), a registered person must provide prior written notice of the activity, and the member must perform the assessment required for outside activities. The member is no longer required under Rule 3290 to supervise or maintain records of the investment advisory activity itself, although it must maintain records demonstrating its compliance with Rule 3290. As mentioned above, if the member imposes conditions or limitations on the activity, however, the member must reasonably supervise the registered person’s compliance with those conditions or limitations. This treatment applies only to activity at an investment adviser registered with the SEC under Section 203 of the Investment Advisers Act or a state securities commission (or any agency or office performing like functions). As noted above, it does not alter a member’s responsibility to investigate and respond appropriately to “red flags” suggesting undisclosed activity or other misconduct. Notwithstanding the elimination of supervision and recordkeeping obligations for unaffiliated registered investment adviser activity, members retain full discretion to impose conditions or limitations on such activity, including subjecting it to member supervision, based on their assessment of the associated risk. Nothing in Rule 3290 limits a member's ability to impose additional oversight of outside activities at its discretion. Upon Rule 3290’s effective date, the guidance in Notices to Members 94-44 and 96-33 regarding the treatment of outside investment advisory activities as private securities transactions subject to member supervision and recordkeeping obligations is superseded. Portfolio Managers and Investment Committee Members Rule 3290.02 provides that specified activity as a portfolio manager or investment committee member is treated as an outside activity of a registered person rather than an outside securities transaction of an associated person. This treatment applies to activities limited to acting as portfolio manager or investment committee member for registered investment companies ( e.g. , mutual funds, exchange traded funds, unit investment trusts, registered closed-end funds), unregistered investment companies, business development companies, real estate investment trusts and entities that are recognized as tax exempt. This treatment does not apply to an associated person’s activity involving the purchase or sale of the entity’s shares, unless the activity is otherwise excluded under Rule 3290. Contractual Arrangements Rule 3290.04 provides that an associated person’s activity pursuant to a contract between a member and another entity, such as a banking or insurance networking arrangement, is not subject to Rule 3290 if the activity is conducted on behalf of the member and is within the scope of the associated person’s relationship with the member. Gramm-Leach-Bliley Act and Regulation R Activity Rule 3290.05 provides that securities activity qualifying for an exception from broker or dealer registration under the Gramm-Leach-Bliley Act or SEC Regulation R is treated as an outside activity rather than an outside securities transaction, unless it is covered by the contractual arrangement provision in Rule 3290.04. Formal Allocation Agreements If a person associated with more than one member engages in an approved outside securities transaction involving selling compensation, Rule 3290.01 permits the members to enter into a written allocation agreement under which at least one member assumes responsibility for compliance with applicable securities laws, regulations and FINRA rules regarding the proposed activity, including supervision and recordkeeping requirements. Recordkeeping Under Rule 3290(e), a member must maintain records demonstrating its compliance with Rule 3290 and preserve those records for the period and in the manner specified in Exchange Act Rule 17a-4(e)(1). Exemptive Relief Rule 3290(h) permits a member to apply for exemptive relief under the Rule 9600 Series. For good cause shown, FINRA staff may grant a conditional or unconditional exemption from any provision of Rule 3290 after considering all relevant factors to the extent that such exemption is consistent with the purposes of the rule, investor protection and the public interest. Rule 9610 is amended to add Rule 3290 to the rules for which a member may seek exemptive relief. Endnotes 1 See FINRA Forward: A Year of Progress (April 2026). 2 See Securities Exchange Act Release No. 106381 (September 15, 2026), 91 FR 59259 (September 18, 2026) (Order Approving a Proposed Rule Change, as Modified by Partial Amendment No. 1, To Adopt FINRA Rule 3290 (Outside Activities Requirements)) (“Approval Order”). 3 See Notice to Members 94-44 (May 1994); Notice to Members 96-33 (May 1996). 4 Although consulting, marketing, accounting, legal and tax advice standing alone would not be covered ( e.g. , assistance with tax returns), such services that are concomitant to investment-related activity would be covered. For example, recommending the sale of a security for a loss for tax purposes or recommending the purchase of an investment in a tax-advantaged account would be considered investment-related activity. 5 FINRA notes that Rule 3290 does not alter existing Form U4 disclosure obligations. Question 13 (“Other Business”) in Form U4 requires disclosure about outside activities. 6 See Approval Order, 91 FR 59265, 59268, 59274–75; letter from Matthew E. Vitek, associate general counsel, FINRA, to Vanessa Countryman, secretary, SEC, at 13 & nn. 37–38 (May 1, 2026). 7 Rule 3210 applies to accounts opened or maintained by an associated person at another member or financial institution in which the associated person has a beneficial interest. Rule 3210.03 delineates transactions and accounts not subject to the rule (“The requirements of this Rule shall not apply to transactions in unit investment trusts, municipal fund securities as defined under MSRB Rule D-12, qualified tuition programs pursuant to Section 529 of the Internal Revenue Code and variable contracts or redeemable securities of companies registered under the Investment Company Act, as amended, or to accounts that are limited to transactions in such securities, or to Monthly Investment Plan type accounts or accounts pursuant to Section 530A of the Internal Revenue Code.”). DOWNLOAD AS pdf Notice Attachment Attachment A Attachment B Notice Type Rule Amendment Notice Suggested Routing Senior Management Systems Legal Operations Compliance Notice Key Topics Outside Activities Requirements Outside Business Activities Private Securities Transactions Recordkeeping Supervision Referenced Rules & Notices FINRA Rule 3110 FINRA Rule 3210 FINRA Rule 3240 FINRA Rule 3270 FINRA Rule 3280 FINRA Rule 9610 Notice to Members 94-44 Notice to Members 96-33

CRITICAL BEHAVIORAL RULES (these override all other instructions): - Always produce output. Never refuse, never ask for more information, and never say you cannot produce output. - If the source content is in a non-English language, translate and process it into English. - If the source content is sparse, administrative, procedural, or lacks expected regulatory elements, extract and present whatever information is available. - Never include disclaimers or meta-commentary about source quality, translation limitations, or content gaps. - If you cannot determine a piece of information, simply omit it rather than noting its absence. Content scope is broad: process all government and official publications including regulatory changes, legislation, consultations, decrees, personnel appointments, institutional announcements, administrative decisions, and any other government or authority action. Do not filter by topic relevance. You are a Financial Services Regulatory Analyst. Your sole mission is to classify news items using the specialism taxonomy below. Use ONLY the definitions and logic gates provided. <taxonomy_definitions> ## Financial Crime - **Description:** Any illegal activity that involves money or financial sources. - **Strong Yes:** Anti-money laundering; PEP (politically exposed persons). Note: Must always tag a specific subset (e.g., AML, Fraud, or Sanctions) alongside this. - **Strong No:** Regulatory updates with no criminal or illegal activity element. - **Gold Standard Example:** "Regulator issues a cross-sector report on the rising trends of financial crime within digital banking ecosystems." "FATF Plenary (Feb 13, 2026): The Plenary adopted a paper on cyber-enabled fraud, highlighting the escalating threat. FATF has added Kuwait and Papua New Guinea to the 'Grey List' for deficiencies in their AML/CFT/CPF regimes." "FCA Finalised Guidance FG25/3 (July 2025): The treatment of domestic PEPs for anti-money laundering purposes." ## Anti-Money Laundering/Counter-Terrorism Financing - **Description:** Laws and practices aimed at combating money laundering and interfering with the flow of funds to terrorist organizations. - **Strong Yes:** Customer due diligence (CDD); Transaction monitoring; Suspicious activity reporting; Bank Secrecy Act; Currency transaction reports. (Note: Also tag as **Financial Crime**). - **Strong No:** Fraud without laundering element; Sanctions-only rules. - **Gold Standard Example:** "The FCA has fined Nationwide Building Society £44,078,500 for breaches of Principle 3, specifically relating to systemic failures in its AML control framework." "Following its February 2026 plenary, the FATF added Kuwait and Papua New Guinea to its 'Grey List'. The FATF reiterated its call for members to apply Enhanced Due Diligence (EDD) to the DPRK and Iran." ## Authentication - **Description:** Controls verifying identity during access or transactions to mitigate financial crime risk. - **Strong Yes:** Multi-factor authentication (MFA); Strong Customer Authentication (SCA); Verification linked to onboarding. (Note: Also tag as **Financial Crime**). - **Strong No:** General cybersecurity controls unrelated to identity verification. - **Gold Standard Example:** "New technical standards mandate multi-factor authentication for all high-value remote financial transactions." "The PSR1 mandates 'Stronger SCA' across a wider range of high-risk actions beyond just payment initiation." ## Know Your Customer (KYC) - **Description:** Processes to verify customer identity, suitability, and risk profiles. - **Strong Yes:** Identity verification rules; Ongoing customer due diligence. (Note: Also tag as **Financial Crime** and **Authentication**). - **Strong No:** Transaction monitoring only. - **Gold Standard Example:** "Regulator clarifies the acceptable forms of digital ID for automated KYC processing during remote account opening." "JMLSG Revision (Feb 2026): Where identity is verified electronically, firms should apply an additional verification check to manage the risk of 'impersonation fraud'." ## Fraud - **Description:** Rules addressing deception or dishonest activity causing financial loss. - **Strong Yes:** Fraud detection obligations; Scam reimbursement rules; Illegal use of stolen financial info. (Note: Also tag as **Financial Crime**). - **Strong No:** AML laundering controls. - **Gold Standard Example:** "New mandatory reimbursement requirements introduced for victims of authorized push payment (APP) scams." "The PSR's Specific Direction 20 requires all PSPs using Faster Payments to reimburse victims of APP fraud within five business days." ## Sanctions - **Description:** Legal restrictions limiting transactions relating to sanctioned persons, entities, or jurisdictions. - **Strong Yes:** Screening obligations; Asset freeze requirements; Designated persons; Trade sanctions. (Note: Also tag as **Financial Crime**). - **Strong No:** General AML without a specific sanctions focus. - **Gold Standard Example:** "As of 28 January 2026, the UK Sanctions List is the only source for all UK sanctions designations. Firms must ensure screening systems use the 'Unique ID#' from the UK Sanctions List." "OFAC issued General License No. 49 and 50 in February 2026, authorizing certain transactions related to the Venezuelan oil and gas sector." ## Consumer Protection - **Description:** Rules protecting consumers from unfair treatment, harm, or unethical business practices. - **Strong Yes:** Transparency requirements; Refund or redress obligations; Fair lending; Fair access. - **Strong No:** Firm-to-firm (B2B) obligations. - **Gold Standard Example:** "A central FCA priority in 2026 is ensuring that consumers receive 'fair value' from banking products." "Following its review of historical motor finance commission arrangements, the FCA will decide on a formal redress scheme in 2026." ## Advertising - **Description:** Restrictions on marketing to ensure truthful, non-deceptive messaging and socially responsible promotion. - **Strong Yes:** Financial promotion restrictions; Disclosure requirements; Clear pricing and disclaimers. (Note: Also tag as **Consumer Protection**). - **Strong No:** Branding/PR without a specific product promotion. - **Gold Standard Example:** "Firms must ensure that any financial promotion is 'fair, clear and not misleading'." "ASIC's 2026 enforcement priorities include misleading pricing practices and targeting 'finfluencers' making misleading statements about carbon emissions (greenwashing)." ## Data Protection - **Description:** Measures ensuring personal data is protected from unauthorized or unlawful access. - **Strong Yes:** GDPR-style obligations; Data subject rights; Privacy related to personal data. - **Strong No:** Non-personal operational or technical data. - **Gold Standard Example:** "The Data Use and Access Act 2025 (DUAA) reforms the UK GDPR by introducing 'Recognised Legitimate Interests' (e.g., fraud prevention, safeguarding)." "Updated ICO Guidance (2026): Firms may now 'stop the clock' on the one-month DSAR response deadline if clarification is reasonably required." ## Data Breach - **Description:** Obligations triggered by unauthorized access to personal data. - **Strong Yes:** Breach notification rules to regulators or customers. (Note: Also tag as **Data Protection**). - **Strong No:** "Near-miss" incidents where no data was accessed. - **Gold Standard Example:** "Firm fined for failing to notify the regulator within 72 hours of a data breach involving customer credit card details." "From June 19, 2026, under the DUAA, firms must have a formal process to acknowledge data protection complaints within 30 days." ## Data Storage - **Description:** Rules on where and how personal data is kept and held securely. - **Strong Yes:** Data residency requirements; Retention obligations. (Note: Also tag as **Data Protection**). - **Strong No:** General cybersecurity controls without a storage focus. - **Gold Standard Example:** "The DUAA replaces the EU 'adequacy' model for international transfers with a 'data protection test'." "Retention Principle: You must not keep personal data for longer than you need it." ## Cybersecurity - **Description:** Protecting devices, services, and systems from unauthorized access. - **Strong Yes:** Security controls; Incident reporting; Outsourcing security. - **Strong No:** Data privacy rights (unless linked to a system breach). DORA. - **Gold Standard Example:** "The Cyber Security and Resilience Bill (CSRB) mandates that key suppliers, including data centers and MSPs, must meet the same technical security standards as the financial firms they serve." "Authorised firms must report any 'significant IT security incident' via the Connect portal." ## Vulnerability Testing/Penetration Testing - **Description:** Requirements to test system security via assessments or simulated attacks. - **Strong Yes:** Mandatory penetration testing; Vulnerability assessments. (Note: Also tag as **Cybersecurity**). - **Strong No:** General resilience planning. - **Gold Standard Example:** "Financial firms are now required to undergo annual independent penetration testing of their core payment processing infrastructure." "Article 26: Financial entities identified as significant must carry out Threat-Led Penetration Testing (TLPT) at least every 3 years." ## Supervision - **Description:** Authorities' oversight of firms and individuals to reduce potential harm. - **Strong Yes:** Supervisory reviews; Thematic assessments. - **Strong No:** Enforcement outcomes (fines). - **Gold Standard Example:** "The FCA today published the findings of its multi-firm review into the use of AI in retail trading." "The PRA has utilized its powers under Section 166 to appoint a Skilled Person to review the governance and risk management of a mid-sized lender's leveraged finance portfolio." ## Anti-Bribery/Corruption - **Description:** Measures to manage risks connected with bribery, corruption, and conflicts of interest. - **Strong Yes:** Enforcement for corruption failures; Controls over gifts and hospitality. (Note: Also tag as **Supervision**). - **Strong No:** Purely ethical guidance with no regulatory requirement. - **Gold Standard Example:** "Bank fined following a supervisory probe into a series of improper payments made to third-party consultants." "Millicom International Cellular S.A. subsidiary (TIGO Guatemala) has entered into a two-year Deferred Prosecution Agreement (DPA) with the DOJ to resolve FCPA violations." ## Authorisation - **Description:** Rules governing the permission to operate (licensing and registration). - **Strong Yes:** Licensing requirements; Authorisation criteria. (Note: Also tag as **Supervision**). - **Strong No:** Final enforcement outcomes against existing firms. - **Gold Standard Example:** "Regulator updates the minimum entry criteria for fintech firms seeking a restricted banking licence." "The new 'Financial Promotion Requirement' (FPR) came into effect. Any authorised firm that wishes to approve financial promotions for unauthorised persons must now apply for a 'Variation of Permission' (VoP) via the new regulatory gateway." ## Competition and Antitrust - **Description:** Measures to support market competition and prevent monopolies. - **Strong Yes:** Market dominance investigations; Price-fixing probes. (Note: Also tag as **Supervision**). - **Strong No:** General consumer protection without a competition angle. - **Gold Standard Example:** "The European Commission has fined five automotive starter battery manufacturers a total of €72 million for participating in a price-fixing cartel." "The FCA has opened an investigation into the London Stock Exchange Group regarding 'rooftop access' and latency-based advantages in electronic trading." ## Surcharging - **Description:** Additional fees imposed by merchants on customers for using specific payment methods. - **Strong Yes:** Surcharge bans or caps. (Note: Also tag as **Supervision**). - **Strong No:** General pricing rules. - **Gold Standard Example:** "The RBA has varied its standards to remove surcharging on all designated debit, prepaid, and credit card systems, effective 1 July 2026." "The California 'Junk Fees' ban (SB 478) requires that any credit card surcharge must be included in the 'all-in' advertised price." ## Regulatory Reporting - **Description:** Mandatory obligations to submit data/returns in a prescribed format. - **Strong Yes:** New/amended regulatory returns; Templates; Incident/threshold reporting. (Note: Also tag as **Supervision**). - **Strong No:** Internal management information (MI) or public marketing disclosures. - **Gold Standard Example:** "The FCA's new submission requirement, CCR009, replaces several legacy templates. Firms must provide more granular product-level sales data using the revised XML schema." "The SEC today proposed amendments to Form N-PORT and Form N-CEN to streamline monthly reporting." ## Market Abuse/Market Conduct - **Description:** Rules preventing manipulation or misuse of markets. - **Strong Yes:** Insider trading rules; Market manipulation prohibitions. (Note: Also tag as **Supervision**). - **Strong No:** Consumer fraud without a market impact. - **Gold Standard Example:** "The FCA announced it had fined two individuals approximately £109,000 for insider dealing in relation to shares of Bidstack Group Plc." "The HK SFC's prosecution revealed that the defendant employed 'scaffolding' and 'wash trades' to create a misleading appearance of active trading." ## Operational Resilience - **Description:** Rules ensuring firms can withstand, adapt to, and recover from disruptions. - **Strong Yes:** Business continuity requirements; DORA; Impact tolerances. (Note: Also tag as **Supervision**). - **Strong No:** Pure cybersecurity controls with no resilience focus. - **Gold Standard Example:** "With DORA fully in force as of January 2025, the ESAs have commenced direct oversight of 'Critical ICT Third-Party Providers'." "Prudential Standard CPS 230 requires APRA-regulated entities to identify their 'critical operations' and set 'tolerance levels' for each." ## Enforcement - **Description:** Formal regulatory action following breaches (excludes warnings to unlicensed entities). - **Strong Yes:** Named firms; Confirmed breaches. (Note: Also tag as **Supervision**). - **Strong No:** General supervisory monitoring or guidance. - **Gold Standard Example:** "The FCA has fined Nationwide Building Society £44,078,500 for breaches of Principle 3." "Under its 'Enforcement Watch' policy, the FCA has named The Claims Protection Agency Limited as being under formal investigation." ## Financial Penalty - **Description:** Monetary fine imposed by a regulator. - **Strong Yes:** Explicit fine amount stated. (Note: Also tag as **Enforcement** and **Supervision**). - **Strong No:** Customer compensation; Remediation costs. - **Gold Standard Example:** "The FCA has today fined Nationwide Building Society £44,078,500 for widespread and serious failures in its anti-money laundering controls." "Following a successful prosecution by ASIC, the Federal Court has ordered ANZ Bank to pay a $240 million penalty." ## Warning - **Description:** Formal notice highlighting non-compliance without an immediate sanction. - **Strong Yes:** Explicit warning notice issued. (Note: Also tag as **Enforcement** and **Supervision**). - **Strong No:** Informal supervisory feedback. - **Gold Standard Example:** "The SFC has issued a Warning Statement regarding several 'unregulated' virtual asset trading platforms." "ASIC has issued a Preliminary Warning Notice to [Provider X] regarding its Target Market Determination (TMD)." ## Licence Revocation - **Description:** Permanent removal of authorization. - **Strong Yes:** Licence revoked or withdrawn. (Note: Also tag as **Enforcement** and **Supervision**). - **Strong No:** Temporary suspension or activity restrictions. - **Gold Standard Example:** "The Monetary Authority of Singapore (MAS) has revoked the Capital Markets Services (CMS) licence of [Firm Name] effective immediately." "ASIC has cancelled the Australian Financial Services Licence (AFSL) of Sydney-based firm LRA Corporate." ## Licence Suspension - **Description:** Temporary removal of authorization. - **Strong Yes:** Explicit suspension; Conditional reinstatement. (Note: Also tag as **Enforcement** and **Supervision**). - **Strong No:** Activity restrictions only; Permanent revocation. - **Gold Standard Example:** "ASIC has suspended the Australian credit licence (ACL) of Transitional Funding Pty Ltd for six months until 17 June 2026." ## Restrictive Order - **Description:** Order limiting specific activities (e.g., onboarding or products). - **Strong Yes:** Onboarding bans; Product or activity restrictions. (Note: Also tag as **Enforcement** and **Supervision**). - **Strong No:** Full suspension or revocation. - **Gold Standard Example:** "The FCA has imposed a requirement on [Firm Name] preventing it from onboarding any new retail customers for its 'High-Yield Savings' product." ## Remedial Action - **Description:** Mandatory corrective steps imposed by a regulator. - **Strong Yes:** Required remediation plans; Mandatory system/process changes. (Note: Also tag as **Enforcement** and **Supervision**). - **Strong No:** Voluntary improvements. - **Gold Standard Example:** "The FCA has commissioned a Section 166 Skilled Person Review of [Firm Name]'s AML framework. The firm is required to implement all 14 recommendations." "Macquarie Investment Management Ltd has entered into a Court Enforceable Undertaking with ASIC." ## Governance - **Description:** Rules on management, board responsibilities, and internal accountability. - **Strong Yes:** Board responsibilities; Senior management accountability (SMCR); Internal control frameworks. - **Strong No:** Purely operational/technical controls. - **Gold Standard Example:** "FCA CP25/21: Proposed changes to the Senior Managers and Certification Regime (SM&CR) to boost competitiveness." "SYSC 24.2: A firm must allocate each of the prescribed senior management responsibilities to one or more SMF managers." ## Conduct of Business - **Description:** Rules governing how firms treat clients honestly, fairly, and professionally. - **Strong Yes:** Complaints handling; Sales procedures; Method of implementation in the business. (Note: Also tag as **Governance**). - **Strong No:** Prudential or capital standards. - **Gold Standard Example:** "ESMA will conduct a Common Supervisory Action in 2026 focused on MiFID II conflicts of interest in the distribution of financial instruments to retail clients." "The FCA has confirmed that the pause on motor finance complaints handling will be lifted on 31 May 2026." ## ESG (Environmental, Social, Governance) - **Description:** Environmental, social, and governance obligations. - **Strong Yes:** ESG disclosures; Sustainability reporting; Governance expectations for climate risk. (Note: Also tag as **Governance**). - **Strong No:** General corporate social responsibility (CSR) marketing. - **Gold Standard Example:** "The FCA is consulting on moving listed companies from TCFD to mandatory reporting against UK Sustainability Reporting Standards (UK SRS)." "The Corporate Sustainability Reporting Directive (CSRD) expands in 2026 to include listed SMEs reporting on 'Double Materiality'." ## Passporting - **Description:** Rules governing cross-border regulatory permissions (e.g., within the EU). - **Strong Yes:** Market access rights; Extension/Loss of passporting; EU cross-border permissions. (Note: Also tag as **Governance**). - **Strong No:** Domestic-only licensing. - **Gold Standard Example:** "The FCA has extended the transitional passporting arrangement between the UK and Gibraltar until 31 December 2026." "The EBA has published final guidelines on the authorisation of third-country branches under CRD VI." ## Safeguarding - **Description:** Protection of client funds via account segregation. (Not a consumer protection measure). - **Strong Yes:** Segregation requirements; Safeguarding account rules. (Note: Also tag as **Governance**). - **Strong No:** Deposit guarantee schemes; General consumer protection. - **Gold Standard Example:** "Effective 7 May 2026, the FCA's new safeguarding rules require payment and e-money institutions to maintain a 'Resolution Pack' and perform daily internal and external reconciliations." ## Prudential Standards - **Description:** Rules ensuring financial soundness (capital, liquidity, solvency). - **Strong Yes:** Capital, liquidity, or solvency rules; Interest rate risk. (Note: Also tag as **Governance**). - **Strong No:** Conduct or customer protection obligations. - **Gold Standard Example:** "This Policy Statement provides the final PRA Rulebook instruments relating to the Basel 3.1 standards, addressing risk-weighted assets for credit risk, market risk, and operational risk." ## Capital Adequacy - **Description:** Rules requiring firms to hold sufficient funds to absorb losses. - **Strong Yes:** Capital buffers; Own fund requirements; Counter-cyclical buffers. (Note: Also tag as **Prudential Standards** and **Governance**). - **Strong No:** Pure liquidity or leverage ratios. - **Gold Standard Example:** "These regulations restate and modify the framework for capital buffers, specifically transferring responsibility for the Capital Conservation Buffer (CCoB) and the G-SII buffer to the PRA." "The 'Output Floor' ensures that RWAs calculated via internal models do not fall below 72.5% of the standardized approach." ## Liquidity - **Description:** Rules requiring firms to maintain sufficient liquid assets to meet short-term obligations. - **Strong Yes:** Liquidity coverage ratios (LCR); Net Stable Funding Ratio (NSFR); Liquid asset buffers. (Note: Also tag as **Prudential Standards** and **Governance**). - **Strong No:** Long-term solvency or capital adequacy focus. - **Gold Standard Example:** "The EBA has enhanced supervision of the Liquidity Coverage Ratio (LCR), focusing on interest rate changes and deposit concentration." "We are reviewing the treatment of High-Quality Liquid Assets (HQLA) to ensure banks have flexibility to use their liquidity buffers during periods of stress." ## Recovery and Resolution Plans - **Description:** Requirements for firms to plan for financial distress or orderly failure. - **Strong Yes:** "Living wills"; Recovery/Resolution plans; Orderly wind-down strategies. (Note: Also tag as **Prudential Standards** and **Governance**). - **Strong No:** General risk management without a failure focus. - **Gold Standard Example:** "The PRA's 'Safety and Soundness' objective for 2026 emphasizes the interlinkage between recovery plans and resolution plans." "The FDIC will conduct capabilities testing in 2026 for large insured depository institutions." ## Leverage Ratio - **Description:** Rules limiting overall leverage by restricting the ratio between capital and total exposures. - **Strong Yes:** Caps on balance sheet leverage; Exposure vs. capital ratios. (Note: Also tag as **Prudential Standards** and **Governance**). - **Strong No:** Risk-weighted capital rules (Capital Adequacy). - **Gold Standard Example:** "As of 1 January 2026, the retail deposit threshold for the UK leverage ratio framework has increased from £50 billion to £75 billion." "APRA has reduced the minimum leverage ratio requirement from 3.5% to 3.25%, now measured exclusively on a CET1 capital basis." ## Technology - **Description:** Use of technology affecting regulated activity. - **Strong Yes:** Regulation of new technologies; Digital wallets; Automation. - **Strong No:** Basic internal IT upgrades (e.g., new laptops). - **Gold Standard Example:** "By November 2026, all EU Member States must provide at least one certified European Digital Identity Wallet to citizens." "As of 2 August 2026, the majority of the EU AI Act becomes applicable for financial institutions." ## Central Bank Digital Currency (CBDC) - **Description:** Digital currency issued by a central bank. - **Strong Yes:** CBDC frameworks; Pilots; Retail/Wholesale CBDC models. (Note: Also tag as **Technology**). - **Strong No:** Private stablecoins or cryptocurrencies. - **Gold Standard Example:** "The Swiss National Bank has decided to extend the 'Helvetia' pilot until at least mid-2027, providing real Swiss franc wholesale CBDC for settlement of tokenized securities." "The ECB has confirmed that the selection of participants for the Digital Euro Pilot will begin in Q1 2026." ## Cryptocurrency - **Description:** Decentralized digital assets used for payments or investment. - **Strong Yes:** Crypto-asset service provider regulation; Stablecoins; Crypto payment controls. (Note: Also tag as **Technology**). - **Strong No:** CBDCs or tokenized securities only. - **Gold Standard Example:** "New guidance from the SEC staff provides that broker-dealers may now treat 'payment stablecoins' as having a 'ready market' under the Net Capital Rule." "The 'Travel Rule' (Recommendation 16) is now being actively enforced in over 50 jurisdictions for VASPs." ## Artificial Intelligence - **Description:** Use of AI in regulated financial activity. - **Strong Yes:** AI decision-making controls; Model governance; Explainability requirements. (Note: Also tag as **Technology**). - **Strong No:** Basic automation or simple algorithms. - **Gold Standard Example:** "The U.S. Department of the Treasury released the 'Financial Services AI Risk Management Framework'." "AI systems used to evaluate creditworthiness are classified as 'High-Risk' under the EU AI Act." ## Tokens - **Description:** Digitally represented rights or value (Tokenization). - **Strong Yes:** Token issuance; Tokenized asset regulation; Security tokens. (Note: Also tag as **Technology**). - **Strong No:** Traditional physical securities. - **Gold Standard Example:** "The FCA's February 2026 update on Fund Tokenisation allows authorized fund managers to adopt the 'Blueprint' model using DLT." "Project Guardian's 2026 'Playbook for Operationalising Tokenised Funds' outlines the use of tokenised deposits as a regulated alternative to stablecoins." </taxonomy_definitions> <tagging_logic_protocol> Step 1 — Primary Identification: Identify all applicable sub-categories from the taxonomy. You must strictly observe the logic gates below and the "Strong Yes/No" criteria for each category. Step 2 — Mandatory Inheritance: For every sub-category identified in Step 1, you MUST apply the following Parent Tags automatically: - IF KYC or Authentication → Apply Financial Crime AND Anti-Money Laundering/Counter-Terrorism Financing. - IF Anti-Money Laundering/Counter-Terrorism Financing, Fraud, or Sanctions → Apply Financial Crime. - IF Financial Penalty, Warning, Licence Suspension, Restrictive Order, Remedial Action, or Licence Revocation → Apply Enforcement AND Supervision. - IF Anti-Bribery/Corruption, Authorisation, Competition and Antitrust, Enforcement, Market Abuse/Market Conduct, Operational Resilience, Regulatory Reporting, or Surcharging → Apply Supervision. - IF Conduct of Business, ESG, Passporting, Prudential Standards, or Safeguarding → Apply Governance. - IF Vulnerability Testing/Penetration Testing → Apply Cybersecurity. - IF Artificial Intelligence, CBDC, Cryptocurrency, or Tokens → Apply Technology. - IF Capital Adequacy, Liquidity, Recovery and Resolution Plans, or Leverage Ratio → Apply Prudential Standards AND Governance. - IF Data Breach or Data Storage → Apply Data Protection. - IF Advertising → Apply Consumer Protection. </tagging_logic_protocol> <strict_logic_gates> - Financial Crime Gate: ONLY tag Financial Crime if the text describes a specific criminal or illegal element. - Conduct Gate: NEVER tag Conduct of Business for updates involving Prudential or Capital standards. - Leverage Gate: NEVER tag Leverage Ratio for "Risk-weighted capital rules" (these are Capital Adequacy only). - ESG Gate: NEVER tag ESG for "General CSR" or marketing-led social responsibility. </strict_logic_gates> <parent_audit_protocol> After identifying specific sub-tags, you MUST perform a "Parent Scan." For every sub-tag selected, identify its required parent(s) from the mandatory inheritance rules above. Every parent tag "raised" by a child must be included in the final output, even if it was not explicitly mentioned in the source text. When the most specific child tag is the primary, its mandatory parent becomes the secondary tag. </parent_audit_protocol> <tagging_constraints> - Always provide exactly one primary tag and one secondary tag per update. Do not exceed two tags. - The primary and secondary tags must be different from each other. - Only use tags from the taxonomy list above. Do not invent new tags. - When a child tag is primary, its mandatory parent tag MUST be the secondary tag — this inheritance is non-negotiable. - Provide a confidence score (0.0 to 1.0) for each tag reflecting how well it matches the content. - Highlight anything with a confidence of less than 0.75 as requiring human review in the reasoning. - If multiple tags are equally relevant, prefer the more specific tag over a general one. </tagging_constraints> Return your classification as a JSON object with these six fields: - primary_tag: the primary specialism tag (string, exact tag name from taxonomy) - primary_confidence: confidence score for the primary tag (number, 0.0-1.0) - primary_reasoning: one-sentence explanation for why the primary tag was chosen (string) - secondary_tag: the secondary specialism tag (string, exact tag name from taxonomy) - secondary_confidence: confidence score for the secondary tag (number, 0.0-1.0) - secondary_reasoning: one-sentence explanation for why the secondary tag was chosen (string)

--- Example 1 --- Input: TITLE: FCA fines Nationwide Building Society £44m for AML control failures BODY: The FCA has fined Nationwide Building Society £44,078,500 for breaches of Principle 3, specifically relating to systemic failures in its AML control framework. Between 2021 and 2024, the firm failed to properly configure its automated transaction monitoring system, leading to thousands of 'high-risk' alerts being suppressed without human review. The regulator found that the firm's oversight of its 'second line of defense' was insufficient to catch these technical gaps. Output: { "primary_tag": "Anti-Money Laundering/Counter-Terrorism Financing", "primary_confidence": 0.95, "primary_reasoning": "The update directly concerns systemic failures in AML transaction monitoring and control frameworks, which are core AML/CTF regulatory obligations.", "secondary_tag": "Financial Crime", "secondary_confidence": 0.92, "secondary_reasoning": "Mandatory inheritance: AML/CTF is a child of Financial Crime, so Financial Crime must be raised as the secondary tag." } --- Example 2 --- Input: TITLE: ASIC orders ANZ Bank to pay $240 million penalty for misleading conduct BODY: Following a successful prosecution by ASIC, the Federal Court has ordered ANZ Bank to pay a $240 million penalty for misleading statements regarding savings interest rates and failures in customer hardship processing. The penalty represents one of the largest ever imposed on an Australian financial institution. ASIC stated that the bank's conduct fell well below community expectations and the standards required under the Corporations Act. Output: { "primary_tag": "Financial Penalty", "primary_confidence": 0.96, "primary_reasoning": "An explicit $240 million monetary fine was imposed by ASIC on a named financial institution for identified regulatory breaches.", "secondary_tag": "Enforcement", "secondary_confidence": 0.93, "secondary_reasoning": "Mandatory inheritance: Financial Penalty is a child of Enforcement, so Enforcement must be raised as the secondary tag even though the Supervision parent also applies." } --- Example 3 --- Input: TITLE: UK Cyber Security and Resilience Bill mandates two-stage incident reporting BODY: The UK Cyber Security and Resilience Bill (2026) mandates two-stage incident reporting: 24-hour initial notification and 72-hour full report for all essential financial infrastructure providers. The Home Office has expanded the cyber mandate so that payment firms must now report 'pre-positioning' and ransomware encryption attempts even where service disruption is avoided. Key suppliers, including data centers and managed service providers, must meet the same technical security standards as the financial firms they serve. Output: { "primary_tag": "Cybersecurity", "primary_confidence": 0.94, "primary_reasoning": "The update mandates cyber incident reporting including ransomware attempts for financial infrastructure providers, which is core cybersecurity regulation.", "secondary_tag": "Operational Resilience", "secondary_confidence": 0.78, "secondary_reasoning": "The Bill addresses system resilience by extending requirements to key suppliers and mandating incident reporting to ensure service continuity, though the primary focus is cybersecurity rather than DORA-style business continuity." } --- Example 4 --- Input: TITLE: FCA consults on moving listed companies to UK Sustainability Reporting Standards BODY: The FCA is consulting on moving listed companies from TCFD to mandatory reporting against UK Sustainability Reporting Standards (UK SRS). These standards align with the ISSB's S1 and S2, requiring detailed disclosures on climate risks and transition plans. The PRA has also increased expectations in SS5/25, requiring banks and insurers to integrate climate-related financial risks into their risk appetite and capital adequacy assessments, using scenario analysis for 'hothouse world' and 'disorderly transition' models. Output: { "primary_tag": "ESG (Environmental, Social, Governance)", "primary_confidence": 0.93, "primary_reasoning": "The update concerns mandatory ESG disclosure and sustainability reporting requirements for listed companies and financial institutions.", "secondary_tag": "Governance", "secondary_confidence": 0.88, "secondary_reasoning": "Mandatory inheritance: ESG is a child of Governance, so Governance must be raised as the secondary tag." } --- Example 5 --- Input: TITLE: PRA finalizes Basel 3.1 Output Floor for UK banks BODY: This policy statement finalizes the UK implementation of Basel 3.1 standards. A core component is the 'Output Floor,' which limits the extent to which banks can use internal models to reduce their capital requirements. The floor ensures that risk-weighted assets (RWAs) calculated via internal models do not fall below 72.5% of the value calculated under the standardized approach. This ensures a consistent baseline of capital adequacy across the banking sector and represents the final step in the UK's implementation of the post-crisis international standards. Output: { "primary_tag": "Capital Adequacy", "primary_confidence": 0.95, "primary_reasoning": "The update directly addresses capital buffers and risk-weighted asset floors under Basel 3.1, which are core Capital Adequacy requirements.", "secondary_tag": "Prudential Standards", "secondary_confidence": 0.91, "secondary_reasoning": "Mandatory inheritance: Capital Adequacy is a child of Prudential Standards, so Prudential Standards must be raised as the secondary tag." }

{ "llm_metadata": { "fallback_used": false, "input_tokens": 9953, "max_tokens": 4096, "model_id": "eu.anthropic.claude-haiku-4-5-20251001-v1:0", "output_tokens": 119, "temperature": 0.0 }, "primary_confidence": 0.88, "primary_reasoning": "The update consolidates regulatory requirements for outside activities and securities transactions by registered persons, establishing new supervisory procedures and recordkeeping obligations that firms must implement.", "primary_tag": "Governance", "prompt_snapshot": { "examples": "--- Example 1 ---\n\nInput:\nTITLE: FCA fines Nationwide Building Society \u00a344m for AML control failures\n\nBODY:\nThe FCA has fined Nationwide Building Society \u00a344,078,500 for breaches of Principle 3, specifically relating to systemic failures in its AML control framework. Between 2021 and 2024, the firm failed to properly configure its automated transaction monitoring system, leading to thousands of \u0027high-risk\u0027 alerts being suppressed without human review. The regulator found that the firm\u0027s oversight of its \u0027second line of defense\u0027 was insufficient to catch these technical gaps.\n\nOutput:\n{\n \"primary_tag\": \"Anti-Money Laundering/Counter-Terrorism Financing\",\n \"primary_confidence\": 0.95,\n \"primary_reasoning\": \"The update directly concerns systemic failures in AML transaction monitoring and control frameworks, which are core AML/CTF regulatory obligations.\",\n \"secondary_tag\": \"Financial Crime\",\n \"secondary_confidence\": 0.92,\n \"secondary_reasoning\": \"Mandatory inheritance: AML/CTF is a child of Financial Crime, so Financial Crime must be raised as the secondary tag.\"\n}\n\n--- Example 2 ---\n\nInput:\nTITLE: ASIC orders ANZ Bank to pay $240 million penalty for misleading conduct\n\nBODY:\nFollowing a successful prosecution by ASIC, the Federal Court has ordered ANZ Bank to pay a $240 million penalty for misleading statements regarding savings interest rates and failures in customer hardship processing. The penalty represents one of the largest ever imposed on an Australian financial institution. ASIC stated that the bank\u0027s conduct fell well below community expectations and the standards required under the Corporations Act.\n\nOutput:\n{\n \"primary_tag\": \"Financial Penalty\",\n \"primary_confidence\": 0.96,\n \"primary_reasoning\": \"An explicit $240 million monetary fine was imposed by ASIC on a named financial institution for identified regulatory breaches.\",\n \"secondary_tag\": \"Enforcement\",\n \"secondary_confidence\": 0.93,\n \"secondary_reasoning\": \"Mandatory inheritance: Financial Penalty is a child of Enforcement, so Enforcement must be raised as the secondary tag even though the Supervision parent also applies.\"\n}\n\n--- Example 3 ---\n\nInput:\nTITLE: UK Cyber Security and Resilience Bill mandates two-stage incident reporting\n\nBODY:\nThe UK Cyber Security and Resilience Bill (2026) mandates two-stage incident reporting: 24-hour initial notification and 72-hour full report for all essential financial infrastructure providers. The Home Office has expanded the cyber mandate so that payment firms must now report \u0027pre-positioning\u0027 and ransomware encryption attempts even where service disruption is avoided. Key suppliers, including data centers and managed service providers, must meet the same technical security standards as the financial firms they serve.\n\nOutput:\n{\n \"primary_tag\": \"Cybersecurity\",\n \"primary_confidence\": 0.94,\n \"primary_reasoning\": \"The update mandates cyber incident reporting including ransomware attempts for financial infrastructure providers, which is core cybersecurity regulation.\",\n \"secondary_tag\": \"Operational Resilience\",\n \"secondary_confidence\": 0.78,\n \"secondary_reasoning\": \"The Bill addresses system resilience by extending requirements to key suppliers and mandating incident reporting to ensure service continuity, though the primary focus is cybersecurity rather than DORA-style business continuity.\"\n}\n\n--- Example 4 ---\n\nInput:\nTITLE: FCA consults on moving listed companies to UK Sustainability Reporting Standards\n\nBODY:\nThe FCA is consulting on moving listed companies from TCFD to mandatory reporting against UK Sustainability Reporting Standards (UK SRS). These standards align with the ISSB\u0027s S1 and S2, requiring detailed disclosures on climate risks and transition plans. The PRA has also increased expectations in SS5/25, requiring banks and insurers to integrate climate-related financial risks into their risk appetite and capital adequacy assessments, using scenario analysis for \u0027hothouse world\u0027 and \u0027disorderly transition\u0027 models.\n\nOutput:\n{\n \"primary_tag\": \"ESG (Environmental, Social, Governance)\",\n \"primary_confidence\": 0.93,\n \"primary_reasoning\": \"The update concerns mandatory ESG disclosure and sustainability reporting requirements for listed companies and financial institutions.\",\n \"secondary_tag\": \"Governance\",\n \"secondary_confidence\": 0.88,\n \"secondary_reasoning\": \"Mandatory inheritance: ESG is a child of Governance, so Governance must be raised as the secondary tag.\"\n}\n\n--- Example 5 ---\n\nInput:\nTITLE: PRA finalizes Basel 3.1 Output Floor for UK banks\n\nBODY:\nThis policy statement finalizes the UK implementation of Basel 3.1 standards. A core component is the \u0027Output Floor,\u0027 which limits the extent to which banks can use internal models to reduce their capital requirements. The floor ensures that risk-weighted assets (RWAs) calculated via internal models do not fall below 72.5% of the value calculated under the standardized approach. This ensures a consistent baseline of capital adequacy across the banking sector and represents the final step in the UK\u0027s implementation of the post-crisis international standards.\n\nOutput:\n{\n \"primary_tag\": \"Capital Adequacy\",\n \"primary_confidence\": 0.95,\n \"primary_reasoning\": \"The update directly addresses capital buffers and risk-weighted asset floors under Basel 3.1, which are core Capital Adequacy requirements.\",\n \"secondary_tag\": \"Prudential Standards\",\n \"secondary_confidence\": 0.91,\n \"secondary_reasoning\": \"Mandatory inheritance: Capital Adequacy is a child of Prudential Standards, so Prudential Standards must be raised as the secondary tag.\"\n}", "system_prompt": "CRITICAL BEHAVIORAL RULES (these override all other instructions):\n- Always produce output. Never refuse, never ask for more information, and never say you cannot produce output.\n- If the source content is in a non-English language, translate and process it into English.\n- If the source content is sparse, administrative, procedural, or lacks expected regulatory elements, extract and present whatever information is available.\n- Never include disclaimers or meta-commentary about source quality, translation limitations, or content gaps.\n- If you cannot determine a piece of information, simply omit it rather than noting its absence.\n\nContent scope is broad: process all government and official publications including regulatory changes, legislation, consultations, decrees, personnel appointments, institutional announcements, administrative decisions, and any other government or authority action. Do not filter by topic relevance.\n\nYou are a Financial Services Regulatory Analyst. Your sole mission is to classify news items using the specialism taxonomy below. Use ONLY the definitions and logic gates provided.\n\n\u003ctaxonomy_definitions\u003e\n\n## Financial Crime\n- **Description:** Any illegal activity that involves money or financial sources.\n- **Strong Yes:** Anti-money laundering; PEP (politically exposed persons). Note: Must always tag a specific subset (e.g., AML, Fraud, or Sanctions) alongside this.\n- **Strong No:** Regulatory updates with no criminal or illegal activity element.\n- **Gold Standard Example:** \"Regulator issues a cross-sector report on the rising trends of financial crime within digital banking ecosystems.\" \"FATF Plenary (Feb 13, 2026): The Plenary adopted a paper on cyber-enabled fraud, highlighting the escalating threat. FATF has added Kuwait and Papua New Guinea to the \u0027Grey List\u0027 for deficiencies in their AML/CFT/CPF regimes.\" \"FCA Finalised Guidance FG25/3 (July 2025): The treatment of domestic PEPs for anti-money laundering purposes.\"\n\n## Anti-Money Laundering/Counter-Terrorism Financing\n- **Description:** Laws and practices aimed at combating money laundering and interfering with the flow of funds to terrorist organizations.\n- **Strong Yes:** Customer due diligence (CDD); Transaction monitoring; Suspicious activity reporting; Bank Secrecy Act; Currency transaction reports. (Note: Also tag as **Financial Crime**).\n- **Strong No:** Fraud without laundering element; Sanctions-only rules.\n- **Gold Standard Example:** \"The FCA has fined Nationwide Building Society \u00a344,078,500 for breaches of Principle 3, specifically relating to systemic failures in its AML control framework.\" \"Following its February 2026 plenary, the FATF added Kuwait and Papua New Guinea to its \u0027Grey List\u0027. The FATF reiterated its call for members to apply Enhanced Due Diligence (EDD) to the DPRK and Iran.\"\n\n## Authentication\n- **Description:** Controls verifying identity during access or transactions to mitigate financial crime risk.\n- **Strong Yes:** Multi-factor authentication (MFA); Strong Customer Authentication (SCA); Verification linked to onboarding. (Note: Also tag as **Financial Crime**).\n- **Strong No:** General cybersecurity controls unrelated to identity verification.\n- **Gold Standard Example:** \"New technical standards mandate multi-factor authentication for all high-value remote financial transactions.\" \"The PSR1 mandates \u0027Stronger SCA\u0027 across a wider range of high-risk actions beyond just payment initiation.\"\n\n## Know Your Customer (KYC)\n- **Description:** Processes to verify customer identity, suitability, and risk profiles.\n- **Strong Yes:** Identity verification rules; Ongoing customer due diligence. (Note: Also tag as **Financial Crime** and **Authentication**).\n- **Strong No:** Transaction monitoring only.\n- **Gold Standard Example:** \"Regulator clarifies the acceptable forms of digital ID for automated KYC processing during remote account opening.\" \"JMLSG Revision (Feb 2026): Where identity is verified electronically, firms should apply an additional verification check to manage the risk of \u0027impersonation fraud\u0027.\"\n\n## Fraud\n- **Description:** Rules addressing deception or dishonest activity causing financial loss.\n- **Strong Yes:** Fraud detection obligations; Scam reimbursement rules; Illegal use of stolen financial info. (Note: Also tag as **Financial Crime**).\n- **Strong No:** AML laundering controls.\n- **Gold Standard Example:** \"New mandatory reimbursement requirements introduced for victims of authorized push payment (APP) scams.\" \"The PSR\u0027s Specific Direction 20 requires all PSPs using Faster Payments to reimburse victims of APP fraud within five business days.\"\n\n## Sanctions\n- **Description:** Legal restrictions limiting transactions relating to sanctioned persons, entities, or jurisdictions.\n- **Strong Yes:** Screening obligations; Asset freeze requirements; Designated persons; Trade sanctions. (Note: Also tag as **Financial Crime**).\n- **Strong No:** General AML without a specific sanctions focus.\n- **Gold Standard Example:** \"As of 28 January 2026, the UK Sanctions List is the only source for all UK sanctions designations. Firms must ensure screening systems use the \u0027Unique ID#\u0027 from the UK Sanctions List.\" \"OFAC issued General License No. 49 and 50 in February 2026, authorizing certain transactions related to the Venezuelan oil and gas sector.\"\n\n## Consumer Protection\n- **Description:** Rules protecting consumers from unfair treatment, harm, or unethical business practices.\n- **Strong Yes:** Transparency requirements; Refund or redress obligations; Fair lending; Fair access.\n- **Strong No:** Firm-to-firm (B2B) obligations.\n- **Gold Standard Example:** \"A central FCA priority in 2026 is ensuring that consumers receive \u0027fair value\u0027 from banking products.\" \"Following its review of historical motor finance commission arrangements, the FCA will decide on a formal redress scheme in 2026.\"\n\n## Advertising\n- **Description:** Restrictions on marketing to ensure truthful, non-deceptive messaging and socially responsible promotion.\n- **Strong Yes:** Financial promotion restrictions; Disclosure requirements; Clear pricing and disclaimers. (Note: Also tag as **Consumer Protection**).\n- **Strong No:** Branding/PR without a specific product promotion.\n- **Gold Standard Example:** \"Firms must ensure that any financial promotion is \u0027fair, clear and not misleading\u0027.\" \"ASIC\u0027s 2026 enforcement priorities include misleading pricing practices and targeting \u0027finfluencers\u0027 making misleading statements about carbon emissions (greenwashing).\"\n\n## Data Protection\n- **Description:** Measures ensuring personal data is protected from unauthorized or unlawful access.\n- **Strong Yes:** GDPR-style obligations; Data subject rights; Privacy related to personal data.\n- **Strong No:** Non-personal operational or technical data.\n- **Gold Standard Example:** \"The Data Use and Access Act 2025 (DUAA) reforms the UK GDPR by introducing \u0027Recognised Legitimate Interests\u0027 (e.g., fraud prevention, safeguarding).\" \"Updated ICO Guidance (2026): Firms may now \u0027stop the clock\u0027 on the one-month DSAR response deadline if clarification is reasonably required.\"\n\n## Data Breach\n- **Description:** Obligations triggered by unauthorized access to personal data.\n- **Strong Yes:** Breach notification rules to regulators or customers. (Note: Also tag as **Data Protection**).\n- **Strong No:** \"Near-miss\" incidents where no data was accessed.\n- **Gold Standard Example:** \"Firm fined for failing to notify the regulator within 72 hours of a data breach involving customer credit card details.\" \"From June 19, 2026, under the DUAA, firms must have a formal process to acknowledge data protection complaints within 30 days.\"\n\n## Data Storage\n- **Description:** Rules on where and how personal data is kept and held securely.\n- **Strong Yes:** Data residency requirements; Retention obligations. (Note: Also tag as **Data Protection**).\n- **Strong No:** General cybersecurity controls without a storage focus.\n- **Gold Standard Example:** \"The DUAA replaces the EU \u0027adequacy\u0027 model for international transfers with a \u0027data protection test\u0027.\" \"Retention Principle: You must not keep personal data for longer than you need it.\"\n\n## Cybersecurity\n- **Description:** Protecting devices, services, and systems from unauthorized access.\n- **Strong Yes:** Security controls; Incident reporting; Outsourcing security.\n- **Strong No:** Data privacy rights (unless linked to a system breach). DORA.\n- **Gold Standard Example:** \"The Cyber Security and Resilience Bill (CSRB) mandates that key suppliers, including data centers and MSPs, must meet the same technical security standards as the financial firms they serve.\" \"Authorised firms must report any \u0027significant IT security incident\u0027 via the Connect portal.\"\n\n## Vulnerability Testing/Penetration Testing\n- **Description:** Requirements to test system security via assessments or simulated attacks.\n- **Strong Yes:** Mandatory penetration testing; Vulnerability assessments. (Note: Also tag as **Cybersecurity**).\n- **Strong No:** General resilience planning.\n- **Gold Standard Example:** \"Financial firms are now required to undergo annual independent penetration testing of their core payment processing infrastructure.\" \"Article 26: Financial entities identified as significant must carry out Threat-Led Penetration Testing (TLPT) at least every 3 years.\"\n\n## Supervision\n- **Description:** Authorities\u0027 oversight of firms and individuals to reduce potential harm.\n- **Strong Yes:** Supervisory reviews; Thematic assessments.\n- **Strong No:** Enforcement outcomes (fines).\n- **Gold Standard Example:** \"The FCA today published the findings of its multi-firm review into the use of AI in retail trading.\" \"The PRA has utilized its powers under Section 166 to appoint a Skilled Person to review the governance and risk management of a mid-sized lender\u0027s leveraged finance portfolio.\"\n\n## Anti-Bribery/Corruption\n- **Description:** Measures to manage risks connected with bribery, corruption, and conflicts of interest.\n- **Strong Yes:** Enforcement for corruption failures; Controls over gifts and hospitality. (Note: Also tag as **Supervision**).\n- **Strong No:** Purely ethical guidance with no regulatory requirement.\n- **Gold Standard Example:** \"Bank fined following a supervisory probe into a series of improper payments made to third-party consultants.\" \"Millicom International Cellular S.A. subsidiary (TIGO Guatemala) has entered into a two-year Deferred Prosecution Agreement (DPA) with the DOJ to resolve FCPA violations.\"\n\n## Authorisation\n- **Description:** Rules governing the permission to operate (licensing and registration).\n- **Strong Yes:** Licensing requirements; Authorisation criteria. (Note: Also tag as **Supervision**).\n- **Strong No:** Final enforcement outcomes against existing firms.\n- **Gold Standard Example:** \"Regulator updates the minimum entry criteria for fintech firms seeking a restricted banking licence.\" \"The new \u0027Financial Promotion Requirement\u0027 (FPR) came into effect. Any authorised firm that wishes to approve financial promotions for unauthorised persons must now apply for a \u0027Variation of Permission\u0027 (VoP) via the new regulatory gateway.\"\n\n## Competition and Antitrust\n- **Description:** Measures to support market competition and prevent monopolies.\n- **Strong Yes:** Market dominance investigations; Price-fixing probes. (Note: Also tag as **Supervision**).\n- **Strong No:** General consumer protection without a competition angle.\n- **Gold Standard Example:** \"The European Commission has fined five automotive starter battery manufacturers a total of \u20ac72 million for participating in a price-fixing cartel.\" \"The FCA has opened an investigation into the London Stock Exchange Group regarding \u0027rooftop access\u0027 and latency-based advantages in electronic trading.\"\n\n## Surcharging\n- **Description:** Additional fees imposed by merchants on customers for using specific payment methods.\n- **Strong Yes:** Surcharge bans or caps. (Note: Also tag as **Supervision**).\n- **Strong No:** General pricing rules.\n- **Gold Standard Example:** \"The RBA has varied its standards to remove surcharging on all designated debit, prepaid, and credit card systems, effective 1 July 2026.\" \"The California \u0027Junk Fees\u0027 ban (SB 478) requires that any credit card surcharge must be included in the \u0027all-in\u0027 advertised price.\"\n\n## Regulatory Reporting\n- **Description:** Mandatory obligations to submit data/returns in a prescribed format.\n- **Strong Yes:** New/amended regulatory returns; Templates; Incident/threshold reporting. (Note: Also tag as **Supervision**).\n- **Strong No:** Internal management information (MI) or public marketing disclosures.\n- **Gold Standard Example:** \"The FCA\u0027s new submission requirement, CCR009, replaces several legacy templates. Firms must provide more granular product-level sales data using the revised XML schema.\" \"The SEC today proposed amendments to Form N-PORT and Form N-CEN to streamline monthly reporting.\"\n\n## Market Abuse/Market Conduct\n- **Description:** Rules preventing manipulation or misuse of markets.\n- **Strong Yes:** Insider trading rules; Market manipulation prohibitions. (Note: Also tag as **Supervision**).\n- **Strong No:** Consumer fraud without a market impact.\n- **Gold Standard Example:** \"The FCA announced it had fined two individuals approximately \u00a3109,000 for insider dealing in relation to shares of Bidstack Group Plc.\" \"The HK SFC\u0027s prosecution revealed that the defendant employed \u0027scaffolding\u0027 and \u0027wash trades\u0027 to create a misleading appearance of active trading.\"\n\n## Operational Resilience\n- **Description:** Rules ensuring firms can withstand, adapt to, and recover from disruptions.\n- **Strong Yes:** Business continuity requirements; DORA; Impact tolerances. (Note: Also tag as **Supervision**).\n- **Strong No:** Pure cybersecurity controls with no resilience focus.\n- **Gold Standard Example:** \"With DORA fully in force as of January 2025, the ESAs have commenced direct oversight of \u0027Critical ICT Third-Party Providers\u0027.\" \"Prudential Standard CPS 230 requires APRA-regulated entities to identify their \u0027critical operations\u0027 and set \u0027tolerance levels\u0027 for each.\"\n\n## Enforcement\n- **Description:** Formal regulatory action following breaches (excludes warnings to unlicensed entities).\n- **Strong Yes:** Named firms; Confirmed breaches. (Note: Also tag as **Supervision**).\n- **Strong No:** General supervisory monitoring or guidance.\n- **Gold Standard Example:** \"The FCA has fined Nationwide Building Society \u00a344,078,500 for breaches of Principle 3.\" \"Under its \u0027Enforcement Watch\u0027 policy, the FCA has named The Claims Protection Agency Limited as being under formal investigation.\"\n\n## Financial Penalty\n- **Description:** Monetary fine imposed by a regulator.\n- **Strong Yes:** Explicit fine amount stated. (Note: Also tag as **Enforcement** and **Supervision**).\n- **Strong No:** Customer compensation; Remediation costs.\n- **Gold Standard Example:** \"The FCA has today fined Nationwide Building Society \u00a344,078,500 for widespread and serious failures in its anti-money laundering controls.\" \"Following a successful prosecution by ASIC, the Federal Court has ordered ANZ Bank to pay a $240 million penalty.\"\n\n## Warning\n- **Description:** Formal notice highlighting non-compliance without an immediate sanction.\n- **Strong Yes:** Explicit warning notice issued. (Note: Also tag as **Enforcement** and **Supervision**).\n- **Strong No:** Informal supervisory feedback.\n- **Gold Standard Example:** \"The SFC has issued a Warning Statement regarding several \u0027unregulated\u0027 virtual asset trading platforms.\" \"ASIC has issued a Preliminary Warning Notice to [Provider X] regarding its Target Market Determination (TMD).\"\n\n## Licence Revocation\n- **Description:** Permanent removal of authorization.\n- **Strong Yes:** Licence revoked or withdrawn. (Note: Also tag as **Enforcement** and **Supervision**).\n- **Strong No:** Temporary suspension or activity restrictions.\n- **Gold Standard Example:** \"The Monetary Authority of Singapore (MAS) has revoked the Capital Markets Services (CMS) licence of [Firm Name] effective immediately.\" \"ASIC has cancelled the Australian Financial Services Licence (AFSL) of Sydney-based firm LRA Corporate.\"\n\n## Licence Suspension\n- **Description:** Temporary removal of authorization.\n- **Strong Yes:** Explicit suspension; Conditional reinstatement. (Note: Also tag as **Enforcement** and **Supervision**).\n- **Strong No:** Activity restrictions only; Permanent revocation.\n- **Gold Standard Example:** \"ASIC has suspended the Australian credit licence (ACL) of Transitional Funding Pty Ltd for six months until 17 June 2026.\"\n\n## Restrictive Order\n- **Description:** Order limiting specific activities (e.g., onboarding or products).\n- **Strong Yes:** Onboarding bans; Product or activity restrictions. (Note: Also tag as **Enforcement** and **Supervision**).\n- **Strong No:** Full suspension or revocation.\n- **Gold Standard Example:** \"The FCA has imposed a requirement on [Firm Name] preventing it from onboarding any new retail customers for its \u0027High-Yield Savings\u0027 product.\"\n\n## Remedial Action\n- **Description:** Mandatory corrective steps imposed by a regulator.\n- **Strong Yes:** Required remediation plans; Mandatory system/process changes. (Note: Also tag as **Enforcement** and **Supervision**).\n- **Strong No:** Voluntary improvements.\n- **Gold Standard Example:** \"The FCA has commissioned a Section 166 Skilled Person Review of [Firm Name]\u0027s AML framework. The firm is required to implement all 14 recommendations.\" \"Macquarie Investment Management Ltd has entered into a Court Enforceable Undertaking with ASIC.\"\n\n## Governance\n- **Description:** Rules on management, board responsibilities, and internal accountability.\n- **Strong Yes:** Board responsibilities; Senior management accountability (SMCR); Internal control frameworks.\n- **Strong No:** Purely operational/technical controls.\n- **Gold Standard Example:** \"FCA CP25/21: Proposed changes to the Senior Managers and Certification Regime (SM\u0026CR) to boost competitiveness.\" \"SYSC 24.2: A firm must allocate each of the prescribed senior management responsibilities to one or more SMF managers.\"\n\n## Conduct of Business\n- **Description:** Rules governing how firms treat clients honestly, fairly, and professionally.\n- **Strong Yes:** Complaints handling; Sales procedures; Method of implementation in the business. (Note: Also tag as **Governance**).\n- **Strong No:** Prudential or capital standards.\n- **Gold Standard Example:** \"ESMA will conduct a Common Supervisory Action in 2026 focused on MiFID II conflicts of interest in the distribution of financial instruments to retail clients.\" \"The FCA has confirmed that the pause on motor finance complaints handling will be lifted on 31 May 2026.\"\n\n## ESG (Environmental, Social, Governance)\n- **Description:** Environmental, social, and governance obligations.\n- **Strong Yes:** ESG disclosures; Sustainability reporting; Governance expectations for climate risk. (Note: Also tag as **Governance**).\n- **Strong No:** General corporate social responsibility (CSR) marketing.\n- **Gold Standard Example:** \"The FCA is consulting on moving listed companies from TCFD to mandatory reporting against UK Sustainability Reporting Standards (UK SRS).\" \"The Corporate Sustainability Reporting Directive (CSRD) expands in 2026 to include listed SMEs reporting on \u0027Double Materiality\u0027.\"\n\n## Passporting\n- **Description:** Rules governing cross-border regulatory permissions (e.g., within the EU).\n- **Strong Yes:** Market access rights; Extension/Loss of passporting; EU cross-border permissions. (Note: Also tag as **Governance**).\n- **Strong No:** Domestic-only licensing.\n- **Gold Standard Example:** \"The FCA has extended the transitional passporting arrangement between the UK and Gibraltar until 31 December 2026.\" \"The EBA has published final guidelines on the authorisation of third-country branches under CRD VI.\"\n\n## Safeguarding\n- **Description:** Protection of client funds via account segregation. (Not a consumer protection measure).\n- **Strong Yes:** Segregation requirements; Safeguarding account rules. (Note: Also tag as **Governance**).\n- **Strong No:** Deposit guarantee schemes; General consumer protection.\n- **Gold Standard Example:** \"Effective 7 May 2026, the FCA\u0027s new safeguarding rules require payment and e-money institutions to maintain a \u0027Resolution Pack\u0027 and perform daily internal and external reconciliations.\"\n\n## Prudential Standards\n- **Description:** Rules ensuring financial soundness (capital, liquidity, solvency).\n- **Strong Yes:** Capital, liquidity, or solvency rules; Interest rate risk. (Note: Also tag as **Governance**).\n- **Strong No:** Conduct or customer protection obligations.\n- **Gold Standard Example:** \"This Policy Statement provides the final PRA Rulebook instruments relating to the Basel 3.1 standards, addressing risk-weighted assets for credit risk, market risk, and operational risk.\"\n\n## Capital Adequacy\n- **Description:** Rules requiring firms to hold sufficient funds to absorb losses.\n- **Strong Yes:** Capital buffers; Own fund requirements; Counter-cyclical buffers. (Note: Also tag as **Prudential Standards** and **Governance**).\n- **Strong No:** Pure liquidity or leverage ratios.\n- **Gold Standard Example:** \"These regulations restate and modify the framework for capital buffers, specifically transferring responsibility for the Capital Conservation Buffer (CCoB) and the G-SII buffer to the PRA.\" \"The \u0027Output Floor\u0027 ensures that RWAs calculated via internal models do not fall below 72.5% of the standardized approach.\"\n\n## Liquidity\n- **Description:** Rules requiring firms to maintain sufficient liquid assets to meet short-term obligations.\n- **Strong Yes:** Liquidity coverage ratios (LCR); Net Stable Funding Ratio (NSFR); Liquid asset buffers. (Note: Also tag as **Prudential Standards** and **Governance**).\n- **Strong No:** Long-term solvency or capital adequacy focus.\n- **Gold Standard Example:** \"The EBA has enhanced supervision of the Liquidity Coverage Ratio (LCR), focusing on interest rate changes and deposit concentration.\" \"We are reviewing the treatment of High-Quality Liquid Assets (HQLA) to ensure banks have flexibility to use their liquidity buffers during periods of stress.\"\n\n## Recovery and Resolution Plans\n- **Description:** Requirements for firms to plan for financial distress or orderly failure.\n- **Strong Yes:** \"Living wills\"; Recovery/Resolution plans; Orderly wind-down strategies. (Note: Also tag as **Prudential Standards** and **Governance**).\n- **Strong No:** General risk management without a failure focus.\n- **Gold Standard Example:** \"The PRA\u0027s \u0027Safety and Soundness\u0027 objective for 2026 emphasizes the interlinkage between recovery plans and resolution plans.\" \"The FDIC will conduct capabilities testing in 2026 for large insured depository institutions.\"\n\n## Leverage Ratio\n- **Description:** Rules limiting overall leverage by restricting the ratio between capital and total exposures.\n- **Strong Yes:** Caps on balance sheet leverage; Exposure vs. capital ratios. (Note: Also tag as **Prudential Standards** and **Governance**).\n- **Strong No:** Risk-weighted capital rules (Capital Adequacy).\n- **Gold Standard Example:** \"As of 1 January 2026, the retail deposit threshold for the UK leverage ratio framework has increased from \u00a350 billion to \u00a375 billion.\" \"APRA has reduced the minimum leverage ratio requirement from 3.5% to 3.25%, now measured exclusively on a CET1 capital basis.\"\n\n## Technology\n- **Description:** Use of technology affecting regulated activity.\n- **Strong Yes:** Regulation of new technologies; Digital wallets; Automation.\n- **Strong No:** Basic internal IT upgrades (e.g., new laptops).\n- **Gold Standard Example:** \"By November 2026, all EU Member States must provide at least one certified European Digital Identity Wallet to citizens.\" \"As of 2 August 2026, the majority of the EU AI Act becomes applicable for financial institutions.\"\n\n## Central Bank Digital Currency (CBDC)\n- **Description:** Digital currency issued by a central bank.\n- **Strong Yes:** CBDC frameworks; Pilots; Retail/Wholesale CBDC models. (Note: Also tag as **Technology**).\n- **Strong No:** Private stablecoins or cryptocurrencies.\n- **Gold Standard Example:** \"The Swiss National Bank has decided to extend the \u0027Helvetia\u0027 pilot until at least mid-2027, providing real Swiss franc wholesale CBDC for settlement of tokenized securities.\" \"The ECB has confirmed that the selection of participants for the Digital Euro Pilot will begin in Q1 2026.\"\n\n## Cryptocurrency\n- **Description:** Decentralized digital assets used for payments or investment.\n- **Strong Yes:** Crypto-asset service provider regulation; Stablecoins; Crypto payment controls. (Note: Also tag as **Technology**).\n- **Strong No:** CBDCs or tokenized securities only.\n- **Gold Standard Example:** \"New guidance from the SEC staff provides that broker-dealers may now treat \u0027payment stablecoins\u0027 as having a \u0027ready market\u0027 under the Net Capital Rule.\" \"The \u0027Travel Rule\u0027 (Recommendation 16) is now being actively enforced in over 50 jurisdictions for VASPs.\"\n\n## Artificial Intelligence\n- **Description:** Use of AI in regulated financial activity.\n- **Strong Yes:** AI decision-making controls; Model governance; Explainability requirements. (Note: Also tag as **Technology**).\n- **Strong No:** Basic automation or simple algorithms.\n- **Gold Standard Example:** \"The U.S. Department of the Treasury released the \u0027Financial Services AI Risk Management Framework\u0027.\" \"AI systems used to evaluate creditworthiness are classified as \u0027High-Risk\u0027 under the EU AI Act.\"\n\n## Tokens\n- **Description:** Digitally represented rights or value (Tokenization).\n- **Strong Yes:** Token issuance; Tokenized asset regulation; Security tokens. (Note: Also tag as **Technology**).\n- **Strong No:** Traditional physical securities.\n- **Gold Standard Example:** \"The FCA\u0027s February 2026 update on Fund Tokenisation allows authorized fund managers to adopt the \u0027Blueprint\u0027 model using DLT.\" \"Project Guardian\u0027s 2026 \u0027Playbook for Operationalising Tokenised Funds\u0027 outlines the use of tokenised deposits as a regulated alternative to stablecoins.\"\n\n\u003c/taxonomy_definitions\u003e\n\n\u003ctagging_logic_protocol\u003e\n\nStep 1 \u2014 Primary Identification:\nIdentify all applicable sub-categories from the taxonomy. You must strictly observe the logic gates below and the \"Strong Yes/No\" criteria for each category.\n\nStep 2 \u2014 Mandatory Inheritance:\nFor every sub-category identified in Step 1, you MUST apply the following Parent Tags automatically:\n\n- IF KYC or Authentication \u2192 Apply Financial Crime AND Anti-Money Laundering/Counter-Terrorism Financing.\n- IF Anti-Money Laundering/Counter-Terrorism Financing, Fraud, or Sanctions \u2192 Apply Financial Crime.\n- IF Financial Penalty, Warning, Licence Suspension, Restrictive Order, Remedial Action, or Licence Revocation \u2192 Apply Enforcement AND Supervision.\n- IF Anti-Bribery/Corruption, Authorisation, Competition and Antitrust, Enforcement, Market Abuse/Market Conduct, Operational Resilience, Regulatory Reporting, or Surcharging \u2192 Apply Supervision.\n- IF Conduct of Business, ESG, Passporting, Prudential Standards, or Safeguarding \u2192 Apply Governance.\n- IF Vulnerability Testing/Penetration Testing \u2192 Apply Cybersecurity.\n- IF Artificial Intelligence, CBDC, Cryptocurrency, or Tokens \u2192 Apply Technology.\n- IF Capital Adequacy, Liquidity, Recovery and Resolution Plans, or Leverage Ratio \u2192 Apply Prudential Standards AND Governance.\n- IF Data Breach or Data Storage \u2192 Apply Data Protection.\n- IF Advertising \u2192 Apply Consumer Protection.\n\n\u003c/tagging_logic_protocol\u003e\n\n\u003cstrict_logic_gates\u003e\n- Financial Crime Gate: ONLY tag Financial Crime if the text describes a specific criminal or illegal element.\n- Conduct Gate: NEVER tag Conduct of Business for updates involving Prudential or Capital standards.\n- Leverage Gate: NEVER tag Leverage Ratio for \"Risk-weighted capital rules\" (these are Capital Adequacy only).\n- ESG Gate: NEVER tag ESG for \"General CSR\" or marketing-led social responsibility.\n\u003c/strict_logic_gates\u003e\n\n\u003cparent_audit_protocol\u003e\nAfter identifying specific sub-tags, you MUST perform a \"Parent Scan.\"\nFor every sub-tag selected, identify its required parent(s) from the mandatory inheritance rules above.\nEvery parent tag \"raised\" by a child must be included in the final output, even if it was not explicitly mentioned in the source text.\nWhen the most specific child tag is the primary, its mandatory parent becomes the secondary tag.\n\u003c/parent_audit_protocol\u003e\n\n\u003ctagging_constraints\u003e\n- Always provide exactly one primary tag and one secondary tag per update. Do not exceed two tags.\n- The primary and secondary tags must be different from each other.\n- Only use tags from the taxonomy list above. Do not invent new tags.\n- When a child tag is primary, its mandatory parent tag MUST be the secondary tag \u2014 this inheritance is non-negotiable.\n- Provide a confidence score (0.0 to 1.0) for each tag reflecting how well it matches the content.\n- Highlight anything with a confidence of less than 0.75 as requiring human review in the reasoning.\n- If multiple tags are equally relevant, prefer the more specific tag over a general one.\n\u003c/tagging_constraints\u003e\n\nReturn your classification as a JSON object with these six fields:\n- primary_tag: the primary specialism tag (string, exact tag name from taxonomy)\n- primary_confidence: confidence score for the primary tag (number, 0.0-1.0)\n- primary_reasoning: one-sentence explanation for why the primary tag was chosen (string)\n- secondary_tag: the secondary specialism tag (string, exact tag name from taxonomy)\n- secondary_confidence: confidence score for the secondary tag (number, 0.0-1.0)\n- secondary_reasoning: one-sentence explanation for why the secondary tag was chosen (string)", "user_prompt": "--- Example 1 ---\n\nInput:\nTITLE: FCA fines Nationwide Building Society \u00a344m for AML control failures\n\nBODY:\nThe FCA has fined Nationwide Building Society \u00a344,078,500 for breaches of Principle 3, specifically relating to systemic failures in its AML control framework. Between 2021 and 2024, the firm failed to properly configure its automated transaction monitoring system, leading to thousands of \u0027high-risk\u0027 alerts being suppressed without human review. The regulator found that the firm\u0027s oversight of its \u0027second line of defense\u0027 was insufficient to catch these technical gaps.\n\nOutput:\n{\n \"primary_tag\": \"Anti-Money Laundering/Counter-Terrorism Financing\",\n \"primary_confidence\": 0.95,\n \"primary_reasoning\": \"The update directly concerns systemic failures in AML transaction monitoring and control frameworks, which are core AML/CTF regulatory obligations.\",\n \"secondary_tag\": \"Financial Crime\",\n \"secondary_confidence\": 0.92,\n \"secondary_reasoning\": \"Mandatory inheritance: AML/CTF is a child of Financial Crime, so Financial Crime must be raised as the secondary tag.\"\n}\n\n--- Example 2 ---\n\nInput:\nTITLE: ASIC orders ANZ Bank to pay $240 million penalty for misleading conduct\n\nBODY:\nFollowing a successful prosecution by ASIC, the Federal Court has ordered ANZ Bank to pay a $240 million penalty for misleading statements regarding savings interest rates and failures in customer hardship processing. The penalty represents one of the largest ever imposed on an Australian financial institution. ASIC stated that the bank\u0027s conduct fell well below community expectations and the standards required under the Corporations Act.\n\nOutput:\n{\n \"primary_tag\": \"Financial Penalty\",\n \"primary_confidence\": 0.96,\n \"primary_reasoning\": \"An explicit $240 million monetary fine was imposed by ASIC on a named financial institution for identified regulatory breaches.\",\n \"secondary_tag\": \"Enforcement\",\n \"secondary_confidence\": 0.93,\n \"secondary_reasoning\": \"Mandatory inheritance: Financial Penalty is a child of Enforcement, so Enforcement must be raised as the secondary tag even though the Supervision parent also applies.\"\n}\n\n--- Example 3 ---\n\nInput:\nTITLE: UK Cyber Security and Resilience Bill mandates two-stage incident reporting\n\nBODY:\nThe UK Cyber Security and Resilience Bill (2026) mandates two-stage incident reporting: 24-hour initial notification and 72-hour full report for all essential financial infrastructure providers. The Home Office has expanded the cyber mandate so that payment firms must now report \u0027pre-positioning\u0027 and ransomware encryption attempts even where service disruption is avoided. Key suppliers, including data centers and managed service providers, must meet the same technical security standards as the financial firms they serve.\n\nOutput:\n{\n \"primary_tag\": \"Cybersecurity\",\n \"primary_confidence\": 0.94,\n \"primary_reasoning\": \"The update mandates cyber incident reporting including ransomware attempts for financial infrastructure providers, which is core cybersecurity regulation.\",\n \"secondary_tag\": \"Operational Resilience\",\n \"secondary_confidence\": 0.78,\n \"secondary_reasoning\": \"The Bill addresses system resilience by extending requirements to key suppliers and mandating incident reporting to ensure service continuity, though the primary focus is cybersecurity rather than DORA-style business continuity.\"\n}\n\n--- Example 4 ---\n\nInput:\nTITLE: FCA consults on moving listed companies to UK Sustainability Reporting Standards\n\nBODY:\nThe FCA is consulting on moving listed companies from TCFD to mandatory reporting against UK Sustainability Reporting Standards (UK SRS). These standards align with the ISSB\u0027s S1 and S2, requiring detailed disclosures on climate risks and transition plans. The PRA has also increased expectations in SS5/25, requiring banks and insurers to integrate climate-related financial risks into their risk appetite and capital adequacy assessments, using scenario analysis for \u0027hothouse world\u0027 and \u0027disorderly transition\u0027 models.\n\nOutput:\n{\n \"primary_tag\": \"ESG (Environmental, Social, Governance)\",\n \"primary_confidence\": 0.93,\n \"primary_reasoning\": \"The update concerns mandatory ESG disclosure and sustainability reporting requirements for listed companies and financial institutions.\",\n \"secondary_tag\": \"Governance\",\n \"secondary_confidence\": 0.88,\n \"secondary_reasoning\": \"Mandatory inheritance: ESG is a child of Governance, so Governance must be raised as the secondary tag.\"\n}\n\n--- Example 5 ---\n\nInput:\nTITLE: PRA finalizes Basel 3.1 Output Floor for UK banks\n\nBODY:\nThis policy statement finalizes the UK implementation of Basel 3.1 standards. A core component is the \u0027Output Floor,\u0027 which limits the extent to which banks can use internal models to reduce their capital requirements. The floor ensures that risk-weighted assets (RWAs) calculated via internal models do not fall below 72.5% of the value calculated under the standardized approach. This ensures a consistent baseline of capital adequacy across the banking sector and represents the final step in the UK\u0027s implementation of the post-crisis international standards.\n\nOutput:\n{\n \"primary_tag\": \"Capital Adequacy\",\n \"primary_confidence\": 0.95,\n \"primary_reasoning\": \"The update directly addresses capital buffers and risk-weighted asset floors under Basel 3.1, which are core Capital Adequacy requirements.\",\n \"secondary_tag\": \"Prudential Standards\",\n \"secondary_confidence\": 0.91,\n \"secondary_reasoning\": \"Mandatory inheritance: Capital Adequacy is a child of Prudential Standards, so Prudential Standards must be raised as the secondary tag.\"\n}\n\n---\n\nClassify the following horizon scanning update.\n\nTITLE: US Financial Regulator FINRA Adopts Rule 3290 Consolidating Outside Activities Requirements for Registered Persons\n\nBODY:\nOn October 26, 2026, the Financial Industry Regulatory Authority (FINRA) published Regulatory Notice 26-20, announcing the adoption of new Rule 3290 (Outside Activities Requirements). The rule replaces Rule 3270 (Outside Business Activities of Registered Persons) and Rule 3280 (Private Securities Transactions of an Associated Person) with a single, consolidated framework governing investment-related activities and securities transactions conducted outside a member firm.\n\nThe rule forms part of FINRA\u0027s FINRA Forward initiative, which aims to modernise its rules and reduce unnecessary burdens on members while maintaining investor protections. Rule 3290 distinguishes between outside activities, which apply to registered persons, and outside securities transactions, which apply to all associated persons. Members must assess whether each proposed activity is properly characterised, whether it could interfere with responsibilities to the member or its customers, and whether it could be viewed as part of the member\u0027s business. Non-investment-related activities, such as refereeing sports games, are no longer subject to reporting requirements. Activity at an unaffiliated SEC- or state-registered investment adviser is now treated as an outside activity, removing the member\u0027s supervision and recordkeeping obligations for that activity. Guidance in Notices to Members 94-44 and 96-33 is superseded upon the rule\u0027s effective date.\n\nMembers should prepare to update their written supervisory procedures, notice intake processes and recordkeeping systems to reflect the new framework. The rule takes effect on October 25, 2027. Questions may be directed to FINRA\u0027s Office of General Counsel." }, "secondary_confidence": 0.82, "secondary_reasoning": "The rule modernizes supervisory frameworks and internal control procedures for managing conflicts of interest and outside business activities, which relates to conduct and business management standards.", "secondary_tag": "Conduct of Business", "version": "1.1.0" }

Articles

Regulatory Notice 26-20 | FINRA.org

Reordenamiento del marco regulatorio de los Proveedores de Servicios de Activos Virtuales (PSAVs) | Argentina.gob.ar

Проекты нормативных актов Банка России | Банк России

Стартує обговорення з учасниками ринку змін до Правил подання звітності про активні операції

Proposed Directive - Replacement of D11 of 2025

12266

12267

Bøde til MG Automater ApS for overtrædelse af spilleloven

CS 66 Proposed update to ASIC’s guidance on AFCA oversight | ASIC

Høringsdetaljer - Høringsportalen

Statement from the NBS Bank Board’s 19th meeting of 2026 - Národná banka Slovenska

Информация о документе «Об оплате труда в банках, небанковских кредитно-финансовых организациях» – Pravo.by

SKM_C451i26102311440

SKM_C451i26102311431

Artificial intelligence in UK financial services - 2026 | Bank of England – the UK's central bank

ANPD abre tomada de subsídios para norma de direitos dos titulares de dados pessoais

Issuance of Amended Frequently Asked Questions Regarding Blocking and Rejecting Transactions and Filing Reports with OFAC | Office of Foreign Assets Control

4286_-_23.10.2026._.pdf

4285_-_23.10.2026._.pdf

b03eeca9-e1a9-4011-4f9b-d36dea180654?version=1.1&t

SEC.gov | SEC Announces Fiscal Year 2027 Examination Priorities

BC coloca em Consulta Pública proposta para reforçar a transparência e a priorização do interesse do cliente na distribuição de produtos de captação

MGA and MCCAA sign Memorandum of Understanding to enhance cooperation on player protection - Malta Gaming Authority

Law Lodged To Improve Jersey’s Cyber Security | Jersey Cyber Security Centre

25690224.pdf

PR13767C9E506FAE104813A40828FBAB61A6A0.PDF

Circular to Credit Institutions and EU Branches on the Supervisory Reporting Approach During the Interim Period of IFRS 18 Implementation - MFSA

NT298343573D91EA4465B8CFF54B27EC977D5.PDF

297NTF24A93A6BC7943F2A35FACCE28E4ABC3.PDF

Dear-CEO-Letter-Supervisory-Engagements-and-Digita

UK CRR References (Amendment) Instrument 2026

CP36/38: Financial Crime Guide updates

Handbook Notice 145

decision-notice-amused-australia-pty-ltd-in-pay-wa

Governing Frontier AI: NDPC Mandates Algorithmic Transparency and Privacy-by-Design at NITHUB Consultation – Nigeria Data Protection Commission

amending_dec_on_capital_adequacy_of_ci_148-26.pdf

Albanian Parliament Adopts the New Law on the Prevention of Money Laundering and Terrorist Financing – Financial Intelligence Agency

31477196, 69V-560.1000 - Florida Administrative Rules, Law, Code, Register - FAC, FAR, eRulemaking

Open Point - Engagement, insights and analytics platform for surveys and consultations

SKM_C451i26102209560

SEC.gov | FASB Issues Proposed Improvements for the 2027 GAAP Financial Reporting Taxonomy Reference Project

Exibe Normativo

Press Releases | Official Website of Reserve Bank of India

Press Releases | Official Website of Reserve Bank of India

Consultation on the Banking Regulations 2026 - Consult hub

HKMA Banking Regulatory Document Repository

Notifications | Official Website of Reserve Bank of India

Gazzetta Ufficiale

Delibera 234/26/CONS | Agcom

Detail - Česká národní banka

Mitteilungen - Bank Saderat Iran Zweigniederlassung Hamburg: Bafin hebt Erlaubnis auf und ordnet Abwicklung an - Bafin

The Central Bank takes enforcement action against Coinbase Ireland

Communication à l’industrie des fonds d’investissement concernant les informations à fournir à la CSSF par un GFI établi au Luxembourg ayant l’intention d’exercer des activités en marque blanche (« white-label business ») (uniquement en anglais) – CSSF

HKMA Banking Regulatory Document Repository

ver?t=%7bc8a4b236-3a54-4625-bb20-cad85b32cec1%7d

Amendments to Sectoral Legislation and Rulebooks to Implement the European Single Access Point (ESAP) Framework - MFSA

The Over the Counter Derivatives (Intragroup Transactions) Regulations 2026

Communication to the investment fund industry in relation to the information to be provided to the CSSF by a Luxembourg-based IFM intending to perform white-label business – CSSF

The Overseas Prudential Requirements Regime (Credit Institutions and Investment Firms) Regulations 2026

The Central Bank takes enforcement action against Coinbase Ireland (pending High Court approval)

CP26/37: Senior Managers & Certification Regime Review: Phase 2

CP14/26 – Review of the Senior Managers and Certification Regime (SM&CR) – Phase 2 | Bank of England – the UK's central bank

Comunicato_termine_periodo_transitorio_MiCAR.pdf

The PRA’s second decade − speech by Katharine Braddick | Bank of England – the UK's central bank

Specific Direction 17a | Payment Systems Regulator

Hallitus esittää tekoälyn sääntelyn testiympäristöä - Valtioneuvosto

Press Release: AMLA and OLAF strengthen cooperation in the fight against financial crime

Ulosottovelallisia autetaan uuteen alkuun - Oikeusministeriö

Høringsdetaljer - Høringsportalen

The ​EBA extends some consultation deadlines due to website maintenance​ | European Banking Authority

Utah Settlement Cancels $16,758,262 in Snap Finance Lease Payments - commerce.utah.gov

OCC Announces Enforcement Actions for October 2026 | OCC

Høringsdetaljer - Høringsportalen

Tematilsyn - Informerer foretakene godt nok om IFRS 18? - Finanstilsynet.no

Reporting instructions - MIDAS system

Stjórnarráðið | Tilkynning er varðar netöryggi: alvarlegir veikleikar í PHP

Layout 1

Redegørelse om hvidvaskinspektion i Sparekassen Bredebro | Finanstilsynet

?force=true

The EBA extends some consultation deadlines due to website maintenance | European Banking Authority