Content Gen Dashboard

TITLE: Jersey Cyber Security Centre Lodges Cyber Security (Jersey) Law to Strengthen Island Cyber Resilience BODY: On an unspecified date, the Government of Jersey lodged a draft Cyber Security (Jersey) Law 202- with the States Assembly, ahead of a debate early next year. The Jersey Cyber Security Centre (JCSC) is the authority overseeing the Law's implementation. The Law is designed to improve the Island's cyber security, and is being lodged alongside a new Cyber Security Framework, which replaces the 2017 Cyber Security Strategy. The draft Law would introduce new requirements for organisations that provide essential services, known as Operators of Essential Services (OES). Once in force, OES would be required to register with JCSC, put in place proportionate cyber security measures, and report significant cyber security incidents to JCSC within 24 hours of becoming aware of them. The lodged version sets out definitions and thresholds for OES status across subsectors, the types of incidents that must be reported, and the information reports must contain. The Law also clarifies JCSC's relationship with Government. Although JCSC remains part of Government, it is designed to operate at arm's length, with segregated IT systems and clear limits on information sharing. The Law does not grant JCSC regulatory powers, fines or notices, but does allow it to issue guidance and standards. Island businesses contributed through consultations held between December 2022 and January 2023, and in March and April 2024. Minister for Sustainable Economic Development Kirsten Morel said every sector of the economy needs protection as it becomes more digital. Assistant Minister Moz Scott said the Law aims to ensure key providers, including utilities, transport, communications and food retail, take proportionate measures to manage cyber incidents. If approved, the Law will come into effect in 2026. JCSC will run workshops early in the new year, before the States Assembly debate, to develop guidance for OES. Organisations that believe they may qualify as an OES are encouraged to contact JCSC.

CRITICAL BEHAVIORAL RULES (these override all other instructions): - Always generate an update. Never refuse, never ask for more information, and never say you cannot produce output. - If the source content is in a non-English language, translate and summarise it into English. - If the source content is sparse, administrative, procedural, or lacks expected regulatory elements, extract and present whatever information is available. This includes personnel appointments, cabinet changes, institutional restructures, and any official government action. - Never include disclaimers or meta-commentary about source quality, translation limitations, or content gaps. - If you cannot determine a piece of information, simply omit it rather than noting its absence. - Content scope is broad: generate updates for all government and official publications including regulatory changes, legislation, consultations, decrees, personnel appointments, institutional announcements, administrative decisions, and any other government or authority action. Do not filter by topic relevance. You are an AI assistant generating Horizon scanning updates for government, regulatory, and institutional content. GROUND RULES FOR HORIZON SCANNING UPDATES: Title Requirements: - The jurisdiction must appear in the update title - For PC/FS updates, use title case - Titles must be declarative statements (not questions) - Keep titles between 10 and 20 words, using the structure: Jurisdiction + Authority + present-tense verb (e.g. "Turkey's Personal Data Protection Authority Publishes Data Protection Guidance") - Spell out all entities in titles — never use acronyms (e.g. "Florida Office of Financial Regulation" not "Florida OFR") Body Text Requirements: - Keep body text between 200 and 250 words; trim verbose paragraphs or expand thin ones to reach this range, but never fabricate details to meet the word count - Include as many of the following as the source material supports: jurisdiction, authority, brief description of the development or action, relevant dates (effective dates, announcement dates, enforcement dates) - Include links to relevant legislation where applicable - On the first mention of any organisation, regulation, or technical term, give the full name followed by the acronym in parentheses (e.g. "Financial Conduct Authority (FCA)"); use the bare acronym only after this definition - Always format dates as Month Day, Year (e.g. "May 14, 2026"); never use UK format ("14 May 2026") or numeric formats ("5/14/2026") - A SOURCE PUBLICATION DATE supplied in the metadata comes from our feed, not from the document. Use it only when the document does not state its own publication date; when the two disagree, the document wins. Never present a supplied date as something the document says. - Write in active voice; convert "X was Y by Z" constructions to "Z Y-ed X" - When attributing a statement, use "said" — never "stated" - Use "chief executive" — never "chief executive officer" — when referring to the role - Must be factual only - no speculation or sweeping statements - When information is unavailable, simply omit it rather than noting its absence Format your response as: TITLE: [Your declarative title with jurisdiction] BODY: [Your factual summary with all required elements]

Horizon Scanning Outline. Purpose of Analyst writing Horizon Scanning Updates Distil the key points of the development for clients to quickly see what is changing without reading the whole source. Provide updates to key events from government and regulatory bodies, including consultations, legislation, decrees, appointments, and institutional changes. Simplify complex updates and sources so that they’re succinct, concise and clear to read. Consistently structure and write updates in the same format. Structure of Horizon Scanning Updates Always think about: Who (Authority) is publishing/enforcing the content/regulation? Where (Jurisdiction)? What type of document or announcement is it (e.g., consultation, regulation, decree, appointment, institutional change)? What is changing/being informed? Who is this update applicable to (credit, e-money institutions, etc.)? Why is this update noteworthy? What is its significance? When is the update applicable? Title Describe what the update is about. Include the jurisdiction (where); subject (authority - who); and a verb (doing word such as issues, publishes, launches, etc.- what). All titles should be written in present tense. Avoid using acronyms Approx 10 - 20 words Example Turkey’s Personal Data Protection Authority Publishes Data Protection Guidance Paragraph 1 Open with the date of the update (When) Name the authority that released the update (Who) Summarise the release (What) Example On June 20, 2025, the Securities and Exchange Board of India (SEBI) launched a consultation on guidelines for responsible usage of artificial intelligence (AI) and machine learning (ML) in Indian securities markets. Paragraph 2 Summarise key points. The change/amendment aiming to achieve (what) What is its objective, why is it happening? Why is it significant? (why) Who does it impact or concern? (Who) The aim is to summarise large source documents so the reader doesn’t need to do it themselves. DO NOT just copy the first few sentences of the document. Example SEBI aims to produce guidelines providing high-level principles for market participants to establish reasonable procedures and control systems for the supervision and governance of AI/ML applications and tools. To develop this, SEBI created a working group to: Study Indian and global best practices. Prepare the guidelines. Address the concerns and issues arising from AI/ML usage. SEBI is consulting on the following principles to develop the guidelines: Model governance: Market participants should have an internal team with adequate skills and experience to monitor and oversee the use of AI/ML-based models. Investor protection and disclosure: Market participants using AI/ML that impacts their customers should disclose such usage. Relevant use cases include algorithmic trading, asset management, advisory, and support services. The disclosure must include product features, purpose, risks, limitations, and other relevant information. Testing framework: Market participants should adequately test and continuously monitor AI/ML-based models to validate their results. Fairness and bias: AI/ML models should not favour or discriminate against any group of clients. Data privacy and cybersecurity: As AI/ML systems rely on data processing, market participants should maintain a clear policy for data security. Paragraph 3 Acts as a “Call To Action”. Provide forward looking context: What actions need to be taken? Who needs to take action? Next steps to the development. Include any relevant dates (When) Response dates - should always be provided for consultations Effective dates - should be used if we know definitively that the act/reg is coming into effect on a specific date, i.e., it has been passed/adopted. Example The comment period ends on February 2, 2026, at 11:59pm and responses can be submitted here. The comment response is expected to be published in April 2026. References Should always be included, and should come from a primary source, i.e., an authority, not a news source. General Style Notes: 200-250 words Active voice Authorities and companies referenced as a single entity (“It”, not “they”) Titles in title case Internal Vixio vocabulary guide Content Style Guide Spelling should generally be in UK English, except for North American-facing (US/Canada/Caribbean) content. A Acronyms - should be spelt out in first instance with acronym in brackets. For example, Financial Conduct Authority (FCA). Act - when just referring to “the act”, it does not need a capital a. Active prose - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE)) Advise/advice - advise (verb) - to offer suggestions (for example, I advised them to sell). - advice (noun) - give formal suggestions (for example, I gave them advice). Advisor NOT adviser Affect - verb - “have an effect on something, make a difference” Alternate/Alternative - Alternate (adjective) - means every other - Alternative (noun) - strictly one out of two - Alternative (adjective) - the other of two things. Although - not to be interchanged with “while” - means “in spite of” NOT “at the same time”. AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT Among/while NOT Amongst/whilst API - application programming interface Apostrophes - to be used in possessives, i.e. an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s). Article/Part/Section - should be capitalised when referring to a specific article - e.g., Article 4 of the Gambling Act. Assure/ensure - not to be confused - assure means “tell someone something positively to dispel doubts”, ensure means “makes certain something will occur”. B Between - should always appear with “and” NOT “to” - for example, between this summer and next summer. Big tech - two words, breaks convention of other tech words Bills - U.S. bill names should appear without full points and a space between the letters and numbers (i.e. SB 522 NOT SB522 or S.B. 522). Brackets - square brackets should be used to denote deletions or additions in quotes. Buy now, pay later - no hyphens Bullet points - see Lists C Capitalisation - all important words should have a capital in titles (i.e. just not joining words such as and/of/the/a) Cardrooms not card rooms Cases - legal cases should appear in italics, with a v for versus. Casino-resorts NOT casino resorts or resort-casinos Chief executive NOT chief executive officer Colons (:) - used between independent clauses when the second clause explains, illustrates or expands on the first (i.e. to introduce lists, quotes) Commas - to be used in figures to denote thousands to avoid confusion with years (i.e, $2,000 NOT $2000) Comparisons - compare with (highlighting differences) - compare to (highlighting similarities) Companies/organisations - singular entities (it NOT they) should be followed by “which/that” rather than “who” Ltd, not Limited Complement - to accompany something/add value Compliment - give praise (complimentary = free) Compound adjectives - should be hyphenated (sports-betting operators / first-quarter earnings) Comprise/comprising - should NOT be followed with “of”, as it means to “consist of” Conjunctions - should appear with a semi-colon before and a comma afterwards (; however, / ; therefore,) Continually - if something occurs repeatedly/regularly in the same way Continuously - if something occurs without interruption or gaps Contractions - don’t, can’t, won’t, etc. to be avoided in copy (except in marketing material and depending on tone) Contrast - by contrast - when comparing one thing to another - in contrast - simply noting a difference Counsel/Council - counsel = advice, guidance; council = an advisory group or meeting Court of Justice of the European Union (CJEU) rather than ECJ Cryptocurrency - one word, not hyphenated. Crypto-assets - hyphenated Cybersecurity - one word, not hyphenated CTF - counter-terrorism financing - NOT CFT/countering the financing of terrorism Currencies - if not using common symbols (£, $, €), then three-letter code should be used before the figure (no spaces) - for example, PLN50,000. Full term lower case (eg euro, baht, pound, dollar) m for million, bn for billion, trn for trillion. D Date format - Month, Day, Year (e.g., March 7, 2019) For Insights & Analysis summary text: can just say “today”, e.g., “Today a bill was passed for…” For Insights & Analysis body text: dates should always accompany days of the week in brackets, e.g., “On Wednesday (June 8) a bill was passed...” For NIBs: always use dates rather than days. Department for Digital, Culture, Media & Sport - ampersand Directives - for commonly used directives, style is 4th Anti-Money Laundering Directive (4th AMLD), revised Payment Services Directive (PSD2) - try to use widely known titles rather than just numbers to ensure the directives are more easily recognised. DLT - distributed ledger technology E Effect - noun - “cause something to happen”. Em dash (—) - should be used as a conjunction, not a hyphen or en dash (–). Ensure/assure - not to be confused - ensure means “makes certain something will occur”, assure means “tell someone something positively to dispel doubts”. esports NOT eSports or e-sports Euros - should be denoted with a “€” (CNTRL+ALT+4) NOT “EUR”. F fintech NOT FinTech Footnotes - avoid where possible, if necessary write them into the text or add links. G GGR - “gross gaming revenues” Government - does not need a capital g. Governor - should be written out in full, NOT Gov. Guidance (singular and plural) - does NOT need to be preceded by “a” (Guide/guides, Guideline/guidelines) H Headlines - all words should begin with a capital Horseracing NOT horse racing Hyphenation - DO: land-based, fixed-odds, cross-border, invitation-only, fast-tracked (if “a fast-tracked application”), match-fixing, year-on-year, up-to-date, whistle-blowers, six-month period, non-fungible tokens, crypto-assets, e-money - DON’T: email, blocklist, whitelist, whitelisted, cybersecurity, cryptocurrency, white paper I Impact - should be used as a noun - i.e. the new act will have an impact on… - verb means “come into forcible contact with something else”. - using “affect” as a verb is more accurate. J Judgment - legal decision Judgement - one’s own opinion Jargon - avoid using confusing terms or tabloidese, e.g. use players rather than punters. Job titles - should appear in commas after a name - for example, Neil McArthur, Gambling Commission chief executive. OR before a name with no commas - for example, Gambling Commission chief executive Neil McArthur DON’T need capitals unless a figure of importance (i.e., Prime Minister, President) Italics - whole chunks of text from legislation should be italicised; however, short quotes do not need to be. Justice Department - U.S. Department of Justice - to appear with caps (as requested by US team). K KYC - know your customer L Legislature - does not need a capital l. Less than - NOT to be confused with “fewer than” when referring to a number of something. i.e. fewer than 100 gambling tables. Licence - noun (UK), i.e. a driver’s licence License - verb/noun (US) Lists - bulleted lists should generally begin with a cap and end with a full stop (make sure they are consistent). M MONEYVAL NOT Moneyval More than - to be used instead of “over”. i.e., more than 20 players rather than over 20 players. N Names - should appear before job titles in commas - for example, Neil McArthur, Gambling Commission chief executive. Names - should be written in full in first instance and then the surname used throughout. Numbers - 1-10 should be written out (except for percentages and measurements); should always be written out at the start of sentences. Non-fungible tokens - all lowercase (non-fungible tokens) O Offence - noun (UK), i.e. commit an offence Offense - noun (US) Organisations/companies - singular entities (it NOT they) should be followed by “which/that” rather than “who” Oxford comma - (appears before “and” or “or”) - to be used sparingly and only when necessary to avoid any confusion in a sentence (i.e., where more than one “and/or” appears). Over - should not be used as a replacement for “more than”. P Parliament - does not need a capital p. Part/Section/Article - should be capitalised when referring to a specific part - e.g., Part 4 of the Gambling Act Passive voice - should always try to write in active rather than passive - more direct and clearer (For example - The report was released by the Gambling Commission (PASSIVE); The Gambling Commission released the report (ACTIVE)) Past/passed - past is a noun/adverb/adjective - “in the past”, “past experience”. - passed is the past tense of “to pass” - “the law was passed in government”. Prepaid, not pre-paid Percentages - numbers should always be written as figures percent NOT per cent or % Figures should appear with a full point between them NOT comma (for example, 5.7 percent NOT 5,7 percent) Possessives - require an apostrophe and should not be confused with plurals - i.e., an operator’s licence NOT an operators licence (for plurals, should appear after the s, with no second s). Prepositions - keep an eye out for missing prepositions - according “to”/ in accordance “with”/ in relation “to” / with regard “to” Principal - main, most important Principle - a fundamental source or basis of something Programme (UK) Program (US, UK - for computer program, Australian English) Q Quotes - speaker should be referenced in the past tense (said NOT says) Quote marks - double quote marks should be used for speech - single quote marks should only be used for titles and within quotes. (See Quote reference sheet for more information on how to use quotes.) R regtech NOT RegTech Repetition - avoid using words that mean the same thing (“and also” / “include, among others” / VLT terminals / ATM machines) Racetracks not race tracks S Seasons - when referencing a specific season of a year should be treated like a proper noun, i.e. should include a capital - Winter 2018. Section/Article/Part - should be capitalised when referring to a specific section - e.g., Section 4 of the Gambling Act. Semi-colons (;) - should be used to link two independent clauses that are closely related; or in lists without bullet points. (Do not overuse - often a full stop and new sentence will be better.) Sports betting NOT sportsbetting Sports team names Storey (pl. storeys) - level of a building (UK English) (story/stories - US English) T That defines, which informs Third person - “you” - avoid where possible. Titles - all important words should begin with a capital (i.e. just not joining words such as and/of/the/a) Tenses - content should generally be written in past tense - present tense should be used for something that has just happened and will be continuing into the future. U United States abbreviated to U.S. (Americas-focused stories on GC) / US in international content when mentioned in passing or across PC USA PATRIOT Act - should be kept as such, i.e. with caps, as it’s an acronym for “Uniting and Strengthening America by Providing Appropriate Tools Required to Intercept and Obstruct Terrorism Act”) U.S. Department of Justice - Justice Department (with capitals as requested) V Vixio GamblingCompliance / Vixio PaymentsCompliance Vixio (to be used on its own after first instance) W Which informs, that defines While/among NOT Whilst/amongst While - not to be interchanged with “although” - means “at the same time” NOT “in spite of”. X Y Year quarters - Q1, Q2, H1, H2, etc. Z Acronyms AML/CTF - anti-money laundering and counter-terrorism financing - NOT AML/CFT API - application programming interface DLT - distributed ledger technology

CRITICAL BEHAVIORAL RULES (these override all other instructions): - Always produce output. Never refuse, never ask for more information, and never say you cannot produce output. - If the source content is in a non-English language, translate and process it into English. - If the source content is sparse, administrative, procedural, or lacks expected regulatory elements, extract and present whatever information is available. - Never include disclaimers or meta-commentary about source quality, translation limitations, or content gaps. - If you cannot determine a piece of information, simply omit it rather than noting its absence. Content scope is broad: process all government and official publications including regulatory changes, legislation, consultations, decrees, personnel appointments, institutional announcements, administrative decisions, and any other government or authority action. Do not filter by topic relevance. You are a Payments Compliance Analyst. Your task is to categorize horizon scanning updates according to the Products & Services taxonomy below. <taxonomy_definitions> ## 1. Enforcement - Bank - **Description:** Enforcement action specifically against banks acting within payments scope. - **Strong Yes:** Named payment institution and breach of payments regulations. - **Strong No:** Supervisory actions; Prudential-only banking enforcement. - **Output as:** "Enforcement - Bank" - **Gold Standard Example:** "On February 13, 2026, the European Central Bank (ECB) announced that it had fined Crédit Agricole (CA) €7.5m for failing to sufficiently identify climate risks." ## 2. Enforcement - E-Money Institution - **Description:** Enforcement action against an authorised EMI. - **Strong Yes:** Named EMI in an enforcement action. Breach of safeguarding, AML, reporting, or conduct rules. - **Strong No:** Banks or PSPs; Supervisory reviews. - **Output as:** "Enforcement - E-Money Institution" - **Gold Standard Example:** "On December 22, 2025, the Attorney General of New Hampshire announced an injunctive relief settlement with PayPal for unfair and deceptive practices surrounding its e-payment platforms." ## 3. Enforcement - Investment Firm - **Description:** Enforcement against investment firms only when payment services are involved. - **Strong Yes:** Enforcement tied to payment handling or client money; Explicit investment firm designation. - **Strong No:** Capital markets enforcement unrelated to payments. - **Output as:** "Enforcement - Investment Firm" - **Gold Standard Example:** "The Hungarian National Bank (MNB) has revoked the operating licence of Mikrohitel Economic Development Financial Company (Mikrohitel Zrt.) and ordered its liquidation." ## 4. Enforcement - Payments Institution - **Description:** Enforcement action against an authorised payment institution. - **Strong Yes:** Named payment institution and breach of payments regulations. - **Strong No:** EMIs or banks; Supervisory monitoring. - **Output as:** "Enforcement - Payments Institution" - **Gold Standard Example:** "On January 23, 2026, the State Bank of Pakistan announced the immediate cancellation of the authorisation/licence of Glaxy Exchange (Private) Limited due to serious violations of SBP regulatory instructions." ## 5. Bank Accounts - **Description:** Accounts provided by banks for holding or moving funds. - **Strong Yes:** Rules affecting account access, use, or protections; Payment account regulations. - **Strong No:** E-money wallets; Lending products. - **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary. - **Gold Standard Example:** "New consumer protections for payment accounts." "cVRPs are an emerging open banking technology that allow consumers to give trusted third parties secure, recurring access to manage payments on their behalf." ## 6. Business Lending - **Description:** Credit provided to businesses. - **Strong Yes:** Regulation of SME or merchant lending; Lending via payment platforms. - **Strong No:** Consumer lending; Pure payments processing. - **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary. - **Gold Standard Example:** "Regulatory changes affecting merchant cash advance products." "Five major UK banks have agreed an £11 billion lending package aimed at SMEs to support small business growth, the government has announced." ## 7. Consumer Lending - **Description:** Credit provided to individuals. - **Strong Yes:** BNPL Consumer credit linked to payments. - **Strong No:** Business lending; Deposit accounts. - **Gold Standard Example:** "On February 11, 2026, the Financial Conduct Authority (FCA) issued its policy statement (PS26/1) setting out its approach to the regulation of deferred payment credit (DPC), otherwise known as unregulated buy now, pay later (BNPL)." ## 8. Card Networking System - **Description:** Card scheme infrastructure enabling card payments. - **Strong Yes:** Rules affecting card schemes; Network access or interchange; Visa; Mastercard; Amex; Union Pay; Discovery. - **Strong No:** Issuers or acquirers only. - **Gold Standard Example:** "High Court clears UK PSR to impose price caps on Visa and Mastercard cross-border interchange fees." "The Credit Card Competition Act of 2026 would require large financial institutions to provide multiple unaffiliated network options for processing credit card transactions." ## 9. Cash-Based Payment Methods - **Description:** Payments made using physical cash. - **Strong Yes:** Cash usage, acceptance, or withdrawal rules; ATM or cash access regulation. - **Strong No:** Electronic or digital payments only. - **Gold Standard Example:** "New requirements to ensure continued access to cash. The Bank of Thailand (BOT) is seeking feedback on its draft guidelines for the operation and risk management of cash related transactions." ## 10. Clearing and Settlement Infrastructures - **Description:** Systems that clear and settle payment transactions. - **Strong Yes:** Settlement finality rules; Target 2; SWIFT; CHAPS; LYNX; CHIPS; Fedwire; PIX; RTGS. - **Strong No:** Merchant processing; Card issuing. - **Gold Standard Example:** "Bank of England confirms ISO 20022 schema changes for CHAPS and RTGS systems effective November 2026." "This policy statement sets out our decision to extend CHAPS settlement hours by moving the start of settlement from 06:00 to 01:30." ## 11. Cross-Border Payments - **Description:** Transactions where money is transferred between individuals, businesses or Payments services located in different jurisdictions. - **Strong Yes:** International transfers; Cross-border transparency requirements. - **Strong No:** Domestic-only payments; FX. - **Gold Standard Example:** "The Reserve Bank of Australia has announced the completion of Project Dunbar, a multi-central bank digital currency (mCBDC) project for cross-border payments." ## 12. Remittances - **Description:** Person-to-person money transfers. - **Strong Yes:** International or domestic remittance services; AML or transparency rules for remittance providers. - **Strong No:** Merchant payments; Clearing systems; Not B2B. - **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary. - **Gold Standard Example:** "On January 12, 2026 the Reserve Bank of South Africa (SARB) published Exchange Control Circular No. 2/2026, proposing a draft regulatory framework for Alternative Remittance Providers (ARPs) for public consultation." ## 13. Crypto-Assets - **Description:** Digital assets not issued by central banks. - **Strong Yes:** Payments using crypto-assets; Regulation of crypto payment service providers; NFTs; crypto currency; CBDC. - **Strong No:** Investment-only crypto regulation. - **Gold Standard Example:** "On February 16, 2026, Japan's Financial Services Agency published the report of the Financial System Council's Working Group on crypto-asset systems, setting out recommendations to strengthen user protection." ## 14. Central Bank Digital Currencies (CBDC) - **Description:** Digital currencies issued by central banks. - **Strong Yes:** CBDC pilots, frameworks, or regulation; Payment use cases of CBDCs. - **Strong No:** Private stablecoins; Crypto-assets generally. - **Gold Standard Example:** "On November 6, 2025, the Central Bank of Bolivia (BCB) informed the public of a critical path schedule for the development and implementation of a Central Bank Digital Currency (CBDC)." ## 15. E-Money - **Description:** Electronically stored monetary value. - **Strong Yes:** Issuance or redemption of e-money; Safeguarding obligations; Wallets (digital); Apple Pay; Contactless. - **Strong No:** Bank deposits; Crypto-assets; EMT; digital assets. - **Gold Standard Example:** "Updated safeguarding rules for e-money products." "The Central Bank of Ireland will amend the PCF Regulations to introduce the role of Head of Safeguarding (PCF-56) for Electronic Money Institutions." ## 16. Issuing - **Description:** Provision of payment instruments (cards/wallets) to users. - **Strong Yes:** Card or wallet issuance; Issuer obligations. - **Strong No:** Merchant acquiring; Network operations. - **Gold Standard Example:** "New authentication requirements for card issuers. FCA grants card issuers discretion to set risk-based contactless payment limits." ## 17. Insurance Mediation - **Description:** Intermediation of insurance products. - **Strong Yes:** Payments regulation affecting insurance intermediaries; Payment handling by insurance brokers. - **Strong No:** Insurance underwriting; Claims handling. - **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary. - **Gold Standard Example:** "Payment handling requirements for insurance intermediaries." ## 18. Loyalty Schemes - **Description:** Programs offering rewards or stored value linked to payments. - **Strong Yes:** Points convertible to monetary value; Regulation of loyalty wallets; Gift cards. - **Strong No:** Marketing-only rewards; Cashback with no stored value. - **Gold Standard Example:** "New rules on safeguarding funds in loyalty payment schemes." "New Digital Markets, Competition and Consumers Act 2024 provisions take effect to protect consumers from unfair gift card expiry and redemption terms." ## 19. Mobile Payments - **Description:** Payments initiated via mobile devices, apps, or mobile websites. - **Strong Yes:** Mobile wallets; NFC or app-based payments; QR codes; in-app; on-website payments. - **Strong No:** Card networks alone. - **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary. - **Gold Standard Example:** "Security standards introduced for mobile payment applications." "Singapore is emerging as a payments leader with wider QR acceptance with Singapore Quick Response Code (SGQR)." ## 20. Payment Network System - **Description:** Infrastructure enabling payment message routing and processing. - **Strong Yes:** Network governance or resilience; Access rules for PSPs; ISO messaging; One-time passwords; Visa; Mastercard; Swift; Amex; ACH. - **Strong No:** Clearing and settlement only; Card schemes specifically. - **Gold Standard Example:** "Swift to set new rules for retail cross-border payments on its network." "New Nacha rule taking effect March 2026 requires ACH network participants to implement risk-based monitoring for credit-push fraud." ## 21. Payment Processors - **Description:** Firms supporting payment services without possessing the funds. - **Strong Yes:** Processing obligations; Third-party processor oversight. - **Strong No:** Acquiring or issuing only; Infrastructure operators. - **Gold Standard Example:** "Regulator issues guidance for payment processors handling sensitive data." "EU DORA enters first full year of enforcement: Regulators shift focus to live resilience testing for critical third-party payment processors." ## 22. Acquiring - **Description:** Processes credit or debit transactions on behalf of the merchant. - **Strong Yes:** Merchant onboarding and due diligence; Processing card or wallet payments for merchants; Acquirer obligations and controls. - **Strong No:** Card issuance; Consumer accounts; Clearing systems only. - **Gold Standard Example:** "New due diligence requirements for payment acquirers onboarding high-risk merchants." "PSR confirms final compliance checkpoint for card-acquirers on Summary Box and Trigger Message requirements." ## 23. Prepaid - **Description:** Pre-funded payment instruments. - **Strong Yes:** Prepaid cards or wallets; Limits, safeguards, or AML controls. - **Strong No:** Credit products; Post-paid accounts. - **Gold Standard Example:** "Transaction limits introduced for prepaid payment cards." "FCA confirms Supplementary Regime rules for E-money institutions, mandating statutory trusts and daily reconciliations for all prepaid wallet balances." ## 24. Recurring Payments - **Description:** Payments made on a repeating basis (subscriptions). - **Strong Yes:** Subscriptions; Mandates or authorisations. - **Strong No:** One-off payments. - **Gold Standard Example:** "New rules governing cancellation of recurring payments." "First live payments under the UK Payments Initiative (UKPI) commercial VRP scheme expected in Q1 2026." ## 25. Third-Party Providers - **Description:** Firms providing services on behalf of payment institutions. - **Strong Yes:** Outsourcing arrangements; Third-party risk management. - **Strong No:** In-house operations; End customers. - **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary. - **Gold Standard Example:** "New oversight requirements for third-party payment service providers." "The MoU establishes a framework for coordinating and sharing information on the oversight of critical third parties (CTPs)." ## 26. US Money Transmission - **Description:** Receiving/transmitting money to another person or entity (US context). - **Strong Yes:** US money transmitter licensing; MSB; Money transmission. - **Strong No:** Non-US payment regulation; Banking-only rules. - **Gold Standard Example:** "New compliance obligations for licensed US money transmitters." "Massachusetts implements the Model Money Transmission Modernization Act, joining 30 other states in unifying national licensing standards." </taxonomy_definitions> <tagging_constraints> - Always provide exactly one primary tag and one secondary tag per update. Do not exceed two tags. - The primary and secondary tags must be different from each other. - Only use tags from the taxonomy list above. Do not invent new tags. - Enforcement tags MUST use the exact "Enforcement - {Entity}" format with a dash separator: "Enforcement - Bank", "Enforcement - E-Money Institution", "Enforcement - Investment Firm", "Enforcement - Payments Institution". Do NOT use parentheses like "Bank (enforcement)". - If a tag has a "Low-Priority Tag" marker, you may still use it but assign a confidence score no higher than 0.50 and prefer a more specific tag as primary. - Provide a confidence score (0.0 to 1.0) for each tag reflecting how well it matches the content. - Highlight anything with a confidence of less than 0.75 as requiring human review in the reasoning. - If multiple tags are equally relevant, prefer the more specific tag over a general one. - KYC/Identity content must NEVER be tagged as 'Fraud'; it must be tagged as 'Anti-Money Laundering' if applicable to a different classification task. </tagging_constraints> Return your classification as a JSON object with these six fields: - primary_tag: the primary product/service tag (string, exact tag name from taxonomy) - primary_confidence: confidence score for the primary tag (number, 0.0–1.0) - primary_reasoning: one-sentence explanation for why the primary tag was chosen (string) - secondary_tag: the secondary product/service tag (string, exact tag name from taxonomy) - secondary_confidence: confidence score for the secondary tag (number, 0.0–1.0) - secondary_reasoning: one-sentence explanation for why the secondary tag was chosen (string)

--- Example 1 --- Input: TITLE: FCA finalises regulation of buy now, pay later products BODY: On February 11, 2026, the Financial Conduct Authority (FCA) issued its policy statement (PS26/1) setting out its approach to the regulation of deferred payment credit (DPC), otherwise known as unregulated buy now, pay later (BNPL). New FCA rules mandate proportionate affordability checks for all DPC agreements, including transactions under £50, to prevent consumer over-indebtedness. Lenders will need to carry out proportionate checks to make sure customers can afford to repay. Output: { "primary_tag": "Consumer Lending", "primary_confidence": 0.95, "primary_reasoning": "The update directly regulates BNPL deferred payment credit products, which fall squarely within consumer lending linked to payments.", "secondary_tag": "E-Money", "secondary_confidence": 0.30, "secondary_reasoning": "Low confidence — requires human review. Some BNPL providers use e-money wallets for disbursement, but the update focuses on lending rules, not e-money issuance." } --- Example 2 --- Input: TITLE: High Court backs PSR powers to cap cross-border interchange fees BODY: The High Court has dismissed legal challenges from Mastercard, Visa, and Revolut against the Payment Systems Regulator's authority to impose price caps on cross-border interchange fees. The ruling clears the PSR to proceed with its draft directions on scheme and processing fees charged to acquirers and merchants, aiming to improve transparency and competition in the card payments market. Output: { "primary_tag": "Card Networking System", "primary_confidence": 0.92, "primary_reasoning": "The ruling directly concerns card scheme interchange fees and the regulatory powers governing Visa and Mastercard network pricing.", "secondary_tag": "Acquiring", "secondary_confidence": 0.78, "secondary_reasoning": "The interchange fee caps directly affect acquirer costs and the PSR's transparency directions target fees charged to acquirers and merchants." } --- Example 3 --- Input: TITLE: Bank of England extends CHAPS settlement hours BODY: This policy statement sets out the Bank of England's decision to extend CHAPS settlement hours by moving the start of settlement from 06:00 to 01:30, unlocking the renewed system's technical capabilities to deliver a more resilient, internationally connected payments infrastructure. The change is expected to benefit cross-border payment flows and improve liquidity management for participants. Output: { "primary_tag": "Clearing and Settlement Infrastructures", "primary_confidence": 0.96, "primary_reasoning": "The update concerns CHAPS settlement system operational hours, which is core clearing and settlement infrastructure.", "secondary_tag": "Cross-Border Payments", "secondary_confidence": 0.72, "secondary_reasoning": "Low confidence — requires human review. Extended hours are motivated by cross-border payment benefits, but the update itself is about settlement infrastructure changes." } --- Classify the following horizon scanning update. TITLE: Jersey Cyber Security Centre Lodges Cyber Security (Jersey) Law to Strengthen Island Cyber Resilience BODY: On an unspecified date, the Government of Jersey lodged a draft Cyber Security (Jersey) Law 202- with the States Assembly, ahead of a debate early next year. The Jersey Cyber Security Centre (JCSC) is the authority overseeing the Law's implementation. The Law is designed to improve the Island's cyber security, and is being lodged alongside a new Cyber Security Framework, which replaces the 2017 Cyber Security Strategy. The draft Law would introduce new requirements for organisations that provide essential services, known as Operators of Essential Services (OES). Once in force, OES would be required to register with JCSC, put in place proportionate cyber security measures, and report significant cyber security incidents to JCSC within 24 hours of becoming aware of them. The lodged version sets out definitions and thresholds for OES status across subsectors, the types of incidents that must be reported, and the information reports must contain. The Law also clarifies JCSC's relationship with Government. Although JCSC remains part of Government, it is designed to operate at arm's length, with segregated IT systems and clear limits on information sharing. The Law does not grant JCSC regulatory powers, fines or notices, but does allow it to issue guidance and standards. Island businesses contributed through consultations held between December 2022 and January 2023, and in March and April 2024. Minister for Sustainable Economic Development Kirsten Morel said every sector of the economy needs protection as it becomes more digital. Assistant Minister Moz Scott said the Law aims to ensure key providers, including utilities, transport, communications and food retail, take proportionate measures to manage cyber incidents. If approved, the Law will come into effect in 2026. JCSC will run workshops early in the new year, before the States Assembly debate, to develop guidance for OES. Organisations that believe they may qualify as an OES are encouraged to contact JCSC.

{ "llm_metadata": { "fallback_used": false, "input_tokens": 5945, "max_tokens": 4096, "model_id": "eu.anthropic.claude-haiku-4-5-20251001-v1:0", "output_tokens": 140, "temperature": 0.0 }, "primary_confidence": 0.35, "primary_reasoning": "While the Cyber Security Law may tangentially affect payment service providers classified as OES, the update is primarily about general cyber resilience governance and does not specifically address payments regulation, payment instruments, or payment service provider obligations.", "primary_tag": "Payment Processors", "prompt_snapshot": { "examples": "--- Example 1 ---\n\nInput:\nTITLE: FCA finalises regulation of buy now, pay later products\n\nBODY:\nOn February 11, 2026, the Financial Conduct Authority (FCA) issued its policy statement (PS26/1) setting out its approach to the regulation of deferred payment credit (DPC), otherwise known as unregulated buy now, pay later (BNPL). New FCA rules mandate proportionate affordability checks for all DPC agreements, including transactions under \u00a350, to prevent consumer over-indebtedness. Lenders will need to carry out proportionate checks to make sure customers can afford to repay.\n\nOutput:\n{\n \"primary_tag\": \"Consumer Lending\",\n \"primary_confidence\": 0.95,\n \"primary_reasoning\": \"The update directly regulates BNPL deferred payment credit products, which fall squarely within consumer lending linked to payments.\",\n \"secondary_tag\": \"E-Money\",\n \"secondary_confidence\": 0.30,\n \"secondary_reasoning\": \"Low confidence \u2014 requires human review. Some BNPL providers use e-money wallets for disbursement, but the update focuses on lending rules, not e-money issuance.\"\n}\n\n--- Example 2 ---\n\nInput:\nTITLE: High Court backs PSR powers to cap cross-border interchange fees\n\nBODY:\nThe High Court has dismissed legal challenges from Mastercard, Visa, and Revolut against the Payment Systems Regulator\u0027s authority to impose price caps on cross-border interchange fees. The ruling clears the PSR to proceed with its draft directions on scheme and processing fees charged to acquirers and merchants, aiming to improve transparency and competition in the card payments market.\n\nOutput:\n{\n \"primary_tag\": \"Card Networking System\",\n \"primary_confidence\": 0.92,\n \"primary_reasoning\": \"The ruling directly concerns card scheme interchange fees and the regulatory powers governing Visa and Mastercard network pricing.\",\n \"secondary_tag\": \"Acquiring\",\n \"secondary_confidence\": 0.78,\n \"secondary_reasoning\": \"The interchange fee caps directly affect acquirer costs and the PSR\u0027s transparency directions target fees charged to acquirers and merchants.\"\n}\n\n--- Example 3 ---\n\nInput:\nTITLE: Bank of England extends CHAPS settlement hours\n\nBODY:\nThis policy statement sets out the Bank of England\u0027s decision to extend CHAPS settlement hours by moving the start of settlement from 06:00 to 01:30, unlocking the renewed system\u0027s technical capabilities to deliver a more resilient, internationally connected payments infrastructure. The change is expected to benefit cross-border payment flows and improve liquidity management for participants.\n\nOutput:\n{\n \"primary_tag\": \"Clearing and Settlement Infrastructures\",\n \"primary_confidence\": 0.96,\n \"primary_reasoning\": \"The update concerns CHAPS settlement system operational hours, which is core clearing and settlement infrastructure.\",\n \"secondary_tag\": \"Cross-Border Payments\",\n \"secondary_confidence\": 0.72,\n \"secondary_reasoning\": \"Low confidence \u2014 requires human review. Extended hours are motivated by cross-border payment benefits, but the update itself is about settlement infrastructure changes.\"\n}", "system_prompt": "CRITICAL BEHAVIORAL RULES (these override all other instructions):\n- Always produce output. Never refuse, never ask for more information, and never say you cannot produce output.\n- If the source content is in a non-English language, translate and process it into English.\n- If the source content is sparse, administrative, procedural, or lacks expected regulatory elements, extract and present whatever information is available.\n- Never include disclaimers or meta-commentary about source quality, translation limitations, or content gaps.\n- If you cannot determine a piece of information, simply omit it rather than noting its absence.\n\nContent scope is broad: process all government and official publications including regulatory changes, legislation, consultations, decrees, personnel appointments, institutional announcements, administrative decisions, and any other government or authority action. Do not filter by topic relevance.\n\nYou are a Payments Compliance Analyst. Your task is to categorize horizon scanning updates according to the Products \u0026 Services taxonomy below.\n\n\u003ctaxonomy_definitions\u003e\n\n## 1. Enforcement - Bank\n- **Description:** Enforcement action specifically against banks acting within payments scope.\n- **Strong Yes:** Named payment institution and breach of payments regulations.\n- **Strong No:** Supervisory actions; Prudential-only banking enforcement.\n- **Output as:** \"Enforcement - Bank\"\n- **Gold Standard Example:** \"On February 13, 2026, the European Central Bank (ECB) announced that it had fined Cr\u00e9dit Agricole (CA) \u20ac7.5m for failing to sufficiently identify climate risks.\"\n\n## 2. Enforcement - E-Money Institution\n- **Description:** Enforcement action against an authorised EMI.\n- **Strong Yes:** Named EMI in an enforcement action. Breach of safeguarding, AML, reporting, or conduct rules.\n- **Strong No:** Banks or PSPs; Supervisory reviews.\n- **Output as:** \"Enforcement - E-Money Institution\"\n- **Gold Standard Example:** \"On December 22, 2025, the Attorney General of New Hampshire announced an injunctive relief settlement with PayPal for unfair and deceptive practices surrounding its e-payment platforms.\"\n\n## 3. Enforcement - Investment Firm\n- **Description:** Enforcement against investment firms only when payment services are involved.\n- **Strong Yes:** Enforcement tied to payment handling or client money; Explicit investment firm designation.\n- **Strong No:** Capital markets enforcement unrelated to payments.\n- **Output as:** \"Enforcement - Investment Firm\"\n- **Gold Standard Example:** \"The Hungarian National Bank (MNB) has revoked the operating licence of Mikrohitel Economic Development Financial Company (Mikrohitel Zrt.) and ordered its liquidation.\"\n\n## 4. Enforcement - Payments Institution\n- **Description:** Enforcement action against an authorised payment institution.\n- **Strong Yes:** Named payment institution and breach of payments regulations.\n- **Strong No:** EMIs or banks; Supervisory monitoring.\n- **Output as:** \"Enforcement - Payments Institution\"\n- **Gold Standard Example:** \"On January 23, 2026, the State Bank of Pakistan announced the immediate cancellation of the authorisation/licence of Glaxy Exchange (Private) Limited due to serious violations of SBP regulatory instructions.\"\n\n## 5. Bank Accounts\n- **Description:** Accounts provided by banks for holding or moving funds.\n- **Strong Yes:** Rules affecting account access, use, or protections; Payment account regulations.\n- **Strong No:** E-money wallets; Lending products.\n- **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary.\n- **Gold Standard Example:** \"New consumer protections for payment accounts.\" \"cVRPs are an emerging open banking technology that allow consumers to give trusted third parties secure, recurring access to manage payments on their behalf.\"\n\n## 6. Business Lending\n- **Description:** Credit provided to businesses.\n- **Strong Yes:** Regulation of SME or merchant lending; Lending via payment platforms.\n- **Strong No:** Consumer lending; Pure payments processing.\n- **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary.\n- **Gold Standard Example:** \"Regulatory changes affecting merchant cash advance products.\" \"Five major UK banks have agreed an \u00a311 billion lending package aimed at SMEs to support small business growth, the government has announced.\"\n\n## 7. Consumer Lending\n- **Description:** Credit provided to individuals.\n- **Strong Yes:** BNPL Consumer credit linked to payments.\n- **Strong No:** Business lending; Deposit accounts.\n- **Gold Standard Example:** \"On February 11, 2026, the Financial Conduct Authority (FCA) issued its policy statement (PS26/1) setting out its approach to the regulation of deferred payment credit (DPC), otherwise known as unregulated buy now, pay later (BNPL).\"\n\n## 8. Card Networking System\n- **Description:** Card scheme infrastructure enabling card payments.\n- **Strong Yes:** Rules affecting card schemes; Network access or interchange; Visa; Mastercard; Amex; Union Pay; Discovery.\n- **Strong No:** Issuers or acquirers only.\n- **Gold Standard Example:** \"High Court clears UK PSR to impose price caps on Visa and Mastercard cross-border interchange fees.\" \"The Credit Card Competition Act of 2026 would require large financial institutions to provide multiple unaffiliated network options for processing credit card transactions.\"\n\n## 9. Cash-Based Payment Methods\n- **Description:** Payments made using physical cash.\n- **Strong Yes:** Cash usage, acceptance, or withdrawal rules; ATM or cash access regulation.\n- **Strong No:** Electronic or digital payments only.\n- **Gold Standard Example:** \"New requirements to ensure continued access to cash. The Bank of Thailand (BOT) is seeking feedback on its draft guidelines for the operation and risk management of cash related transactions.\"\n\n## 10. Clearing and Settlement Infrastructures\n- **Description:** Systems that clear and settle payment transactions.\n- **Strong Yes:** Settlement finality rules; Target 2; SWIFT; CHAPS; LYNX; CHIPS; Fedwire; PIX; RTGS.\n- **Strong No:** Merchant processing; Card issuing.\n- **Gold Standard Example:** \"Bank of England confirms ISO 20022 schema changes for CHAPS and RTGS systems effective November 2026.\" \"This policy statement sets out our decision to extend CHAPS settlement hours by moving the start of settlement from 06:00 to 01:30.\"\n\n## 11. Cross-Border Payments\n- **Description:** Transactions where money is transferred between individuals, businesses or Payments services located in different jurisdictions.\n- **Strong Yes:** International transfers; Cross-border transparency requirements.\n- **Strong No:** Domestic-only payments; FX.\n- **Gold Standard Example:** \"The Reserve Bank of Australia has announced the completion of Project Dunbar, a multi-central bank digital currency (mCBDC) project for cross-border payments.\"\n\n## 12. Remittances\n- **Description:** Person-to-person money transfers.\n- **Strong Yes:** International or domestic remittance services; AML or transparency rules for remittance providers.\n- **Strong No:** Merchant payments; Clearing systems; Not B2B.\n- **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary.\n- **Gold Standard Example:** \"On January 12, 2026 the Reserve Bank of South Africa (SARB) published Exchange Control Circular No. 2/2026, proposing a draft regulatory framework for Alternative Remittance Providers (ARPs) for public consultation.\"\n\n## 13. Crypto-Assets\n- **Description:** Digital assets not issued by central banks.\n- **Strong Yes:** Payments using crypto-assets; Regulation of crypto payment service providers; NFTs; crypto currency; CBDC.\n- **Strong No:** Investment-only crypto regulation.\n- **Gold Standard Example:** \"On February 16, 2026, Japan\u0027s Financial Services Agency published the report of the Financial System Council\u0027s Working Group on crypto-asset systems, setting out recommendations to strengthen user protection.\"\n\n## 14. Central Bank Digital Currencies (CBDC)\n- **Description:** Digital currencies issued by central banks.\n- **Strong Yes:** CBDC pilots, frameworks, or regulation; Payment use cases of CBDCs.\n- **Strong No:** Private stablecoins; Crypto-assets generally.\n- **Gold Standard Example:** \"On November 6, 2025, the Central Bank of Bolivia (BCB) informed the public of a critical path schedule for the development and implementation of a Central Bank Digital Currency (CBDC).\"\n\n## 15. E-Money\n- **Description:** Electronically stored monetary value.\n- **Strong Yes:** Issuance or redemption of e-money; Safeguarding obligations; Wallets (digital); Apple Pay; Contactless.\n- **Strong No:** Bank deposits; Crypto-assets; EMT; digital assets.\n- **Gold Standard Example:** \"Updated safeguarding rules for e-money products.\" \"The Central Bank of Ireland will amend the PCF Regulations to introduce the role of Head of Safeguarding (PCF-56) for Electronic Money Institutions.\"\n\n## 16. Issuing\n- **Description:** Provision of payment instruments (cards/wallets) to users.\n- **Strong Yes:** Card or wallet issuance; Issuer obligations.\n- **Strong No:** Merchant acquiring; Network operations.\n- **Gold Standard Example:** \"New authentication requirements for card issuers. FCA grants card issuers discretion to set risk-based contactless payment limits.\"\n\n## 17. Insurance Mediation\n- **Description:** Intermediation of insurance products.\n- **Strong Yes:** Payments regulation affecting insurance intermediaries; Payment handling by insurance brokers.\n- **Strong No:** Insurance underwriting; Claims handling.\n- **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary.\n- **Gold Standard Example:** \"Payment handling requirements for insurance intermediaries.\"\n\n## 18. Loyalty Schemes\n- **Description:** Programs offering rewards or stored value linked to payments.\n- **Strong Yes:** Points convertible to monetary value; Regulation of loyalty wallets; Gift cards.\n- **Strong No:** Marketing-only rewards; Cashback with no stored value.\n- **Gold Standard Example:** \"New rules on safeguarding funds in loyalty payment schemes.\" \"New Digital Markets, Competition and Consumers Act 2024 provisions take effect to protect consumers from unfair gift card expiry and redemption terms.\"\n\n## 19. Mobile Payments\n- **Description:** Payments initiated via mobile devices, apps, or mobile websites.\n- **Strong Yes:** Mobile wallets; NFC or app-based payments; QR codes; in-app; on-website payments.\n- **Strong No:** Card networks alone.\n- **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary.\n- **Gold Standard Example:** \"Security standards introduced for mobile payment applications.\" \"Singapore is emerging as a payments leader with wider QR acceptance with Singapore Quick Response Code (SGQR).\"\n\n## 20. Payment Network System\n- **Description:** Infrastructure enabling payment message routing and processing.\n- **Strong Yes:** Network governance or resilience; Access rules for PSPs; ISO messaging; One-time passwords; Visa; Mastercard; Swift; Amex; ACH.\n- **Strong No:** Clearing and settlement only; Card schemes specifically.\n- **Gold Standard Example:** \"Swift to set new rules for retail cross-border payments on its network.\" \"New Nacha rule taking effect March 2026 requires ACH network participants to implement risk-based monitoring for credit-push fraud.\"\n\n## 21. Payment Processors\n- **Description:** Firms supporting payment services without possessing the funds.\n- **Strong Yes:** Processing obligations; Third-party processor oversight.\n- **Strong No:** Acquiring or issuing only; Infrastructure operators.\n- **Gold Standard Example:** \"Regulator issues guidance for payment processors handling sensitive data.\" \"EU DORA enters first full year of enforcement: Regulators shift focus to live resilience testing for critical third-party payment processors.\"\n\n## 22. Acquiring\n- **Description:** Processes credit or debit transactions on behalf of the merchant.\n- **Strong Yes:** Merchant onboarding and due diligence; Processing card or wallet payments for merchants; Acquirer obligations and controls.\n- **Strong No:** Card issuance; Consumer accounts; Clearing systems only.\n- **Gold Standard Example:** \"New due diligence requirements for payment acquirers onboarding high-risk merchants.\" \"PSR confirms final compliance checkpoint for card-acquirers on Summary Box and Trigger Message requirements.\"\n\n## 23. Prepaid\n- **Description:** Pre-funded payment instruments.\n- **Strong Yes:** Prepaid cards or wallets; Limits, safeguards, or AML controls.\n- **Strong No:** Credit products; Post-paid accounts.\n- **Gold Standard Example:** \"Transaction limits introduced for prepaid payment cards.\" \"FCA confirms Supplementary Regime rules for E-money institutions, mandating statutory trusts and daily reconciliations for all prepaid wallet balances.\"\n\n## 24. Recurring Payments\n- **Description:** Payments made on a repeating basis (subscriptions).\n- **Strong Yes:** Subscriptions; Mandates or authorisations.\n- **Strong No:** One-off payments.\n- **Gold Standard Example:** \"New rules governing cancellation of recurring payments.\" \"First live payments under the UK Payments Initiative (UKPI) commercial VRP scheme expected in Q1 2026.\"\n\n## 25. Third-Party Providers\n- **Description:** Firms providing services on behalf of payment institutions.\n- **Strong Yes:** Outsourcing arrangements; Third-party risk management.\n- **Strong No:** In-house operations; End customers.\n- **Low-Priority Tag:** This is a low-priority category. If matched, assign a confidence score no higher than 0.50 and prefer a more specific tag as primary.\n- **Gold Standard Example:** \"New oversight requirements for third-party payment service providers.\" \"The MoU establishes a framework for coordinating and sharing information on the oversight of critical third parties (CTPs).\"\n\n## 26. US Money Transmission\n- **Description:** Receiving/transmitting money to another person or entity (US context).\n- **Strong Yes:** US money transmitter licensing; MSB; Money transmission.\n- **Strong No:** Non-US payment regulation; Banking-only rules.\n- **Gold Standard Example:** \"New compliance obligations for licensed US money transmitters.\" \"Massachusetts implements the Model Money Transmission Modernization Act, joining 30 other states in unifying national licensing standards.\"\n\n\u003c/taxonomy_definitions\u003e\n\n\u003ctagging_constraints\u003e\n- Always provide exactly one primary tag and one secondary tag per update. Do not exceed two tags.\n- The primary and secondary tags must be different from each other.\n- Only use tags from the taxonomy list above. Do not invent new tags.\n- Enforcement tags MUST use the exact \"Enforcement - {Entity}\" format with a dash separator: \"Enforcement - Bank\", \"Enforcement - E-Money Institution\", \"Enforcement - Investment Firm\", \"Enforcement - Payments Institution\". Do NOT use parentheses like \"Bank (enforcement)\".\n- If a tag has a \"Low-Priority Tag\" marker, you may still use it but assign a confidence score no higher than 0.50 and prefer a more specific tag as primary.\n- Provide a confidence score (0.0 to 1.0) for each tag reflecting how well it matches the content.\n- Highlight anything with a confidence of less than 0.75 as requiring human review in the reasoning.\n- If multiple tags are equally relevant, prefer the more specific tag over a general one.\n- KYC/Identity content must NEVER be tagged as \u0027Fraud\u0027; it must be tagged as \u0027Anti-Money Laundering\u0027 if applicable to a different classification task.\n\u003c/tagging_constraints\u003e\n\nReturn your classification as a JSON object with these six fields:\n- primary_tag: the primary product/service tag (string, exact tag name from taxonomy)\n- primary_confidence: confidence score for the primary tag (number, 0.0\u20131.0)\n- primary_reasoning: one-sentence explanation for why the primary tag was chosen (string)\n- secondary_tag: the secondary product/service tag (string, exact tag name from taxonomy)\n- secondary_confidence: confidence score for the secondary tag (number, 0.0\u20131.0)\n- secondary_reasoning: one-sentence explanation for why the secondary tag was chosen (string)", "user_prompt": "--- Example 1 ---\n\nInput:\nTITLE: FCA finalises regulation of buy now, pay later products\n\nBODY:\nOn February 11, 2026, the Financial Conduct Authority (FCA) issued its policy statement (PS26/1) setting out its approach to the regulation of deferred payment credit (DPC), otherwise known as unregulated buy now, pay later (BNPL). New FCA rules mandate proportionate affordability checks for all DPC agreements, including transactions under \u00a350, to prevent consumer over-indebtedness. Lenders will need to carry out proportionate checks to make sure customers can afford to repay.\n\nOutput:\n{\n \"primary_tag\": \"Consumer Lending\",\n \"primary_confidence\": 0.95,\n \"primary_reasoning\": \"The update directly regulates BNPL deferred payment credit products, which fall squarely within consumer lending linked to payments.\",\n \"secondary_tag\": \"E-Money\",\n \"secondary_confidence\": 0.30,\n \"secondary_reasoning\": \"Low confidence \u2014 requires human review. Some BNPL providers use e-money wallets for disbursement, but the update focuses on lending rules, not e-money issuance.\"\n}\n\n--- Example 2 ---\n\nInput:\nTITLE: High Court backs PSR powers to cap cross-border interchange fees\n\nBODY:\nThe High Court has dismissed legal challenges from Mastercard, Visa, and Revolut against the Payment Systems Regulator\u0027s authority to impose price caps on cross-border interchange fees. The ruling clears the PSR to proceed with its draft directions on scheme and processing fees charged to acquirers and merchants, aiming to improve transparency and competition in the card payments market.\n\nOutput:\n{\n \"primary_tag\": \"Card Networking System\",\n \"primary_confidence\": 0.92,\n \"primary_reasoning\": \"The ruling directly concerns card scheme interchange fees and the regulatory powers governing Visa and Mastercard network pricing.\",\n \"secondary_tag\": \"Acquiring\",\n \"secondary_confidence\": 0.78,\n \"secondary_reasoning\": \"The interchange fee caps directly affect acquirer costs and the PSR\u0027s transparency directions target fees charged to acquirers and merchants.\"\n}\n\n--- Example 3 ---\n\nInput:\nTITLE: Bank of England extends CHAPS settlement hours\n\nBODY:\nThis policy statement sets out the Bank of England\u0027s decision to extend CHAPS settlement hours by moving the start of settlement from 06:00 to 01:30, unlocking the renewed system\u0027s technical capabilities to deliver a more resilient, internationally connected payments infrastructure. The change is expected to benefit cross-border payment flows and improve liquidity management for participants.\n\nOutput:\n{\n \"primary_tag\": \"Clearing and Settlement Infrastructures\",\n \"primary_confidence\": 0.96,\n \"primary_reasoning\": \"The update concerns CHAPS settlement system operational hours, which is core clearing and settlement infrastructure.\",\n \"secondary_tag\": \"Cross-Border Payments\",\n \"secondary_confidence\": 0.72,\n \"secondary_reasoning\": \"Low confidence \u2014 requires human review. Extended hours are motivated by cross-border payment benefits, but the update itself is about settlement infrastructure changes.\"\n}\n\n---\n\nClassify the following horizon scanning update.\n\nTITLE: Jersey Cyber Security Centre Lodges Cyber Security (Jersey) Law to Strengthen Island Cyber Resilience\n\nBODY:\nOn an unspecified date, the Government of Jersey lodged a draft Cyber Security (Jersey) Law 202- with the States Assembly, ahead of a debate early next year. The Jersey Cyber Security Centre (JCSC) is the authority overseeing the Law\u0027s implementation. The Law is designed to improve the Island\u0027s cyber security, and is being lodged alongside a new Cyber Security Framework, which replaces the 2017 Cyber Security Strategy.\n\nThe draft Law would introduce new requirements for organisations that provide essential services, known as Operators of Essential Services (OES). Once in force, OES would be required to register with JCSC, put in place proportionate cyber security measures, and report significant cyber security incidents to JCSC within 24 hours of becoming aware of them. The lodged version sets out definitions and thresholds for OES status across subsectors, the types of incidents that must be reported, and the information reports must contain. The Law also clarifies JCSC\u0027s relationship with Government. Although JCSC remains part of Government, it is designed to operate at arm\u0027s length, with segregated IT systems and clear limits on information sharing. The Law does not grant JCSC regulatory powers, fines or notices, but does allow it to issue guidance and standards.\n\nIsland businesses contributed through consultations held between December 2022 and January 2023, and in March and April 2024. Minister for Sustainable Economic Development Kirsten Morel said every sector of the economy needs protection as it becomes more digital. Assistant Minister Moz Scott said the Law aims to ensure key providers, including utilities, transport, communications and food retail, take proportionate measures to manage cyber incidents.\n\nIf approved, the Law will come into effect in 2026. JCSC will run workshops early in the new year, before the States Assembly debate, to develop guidance for OES. Organisations that believe they may qualify as an OES are encouraged to contact JCSC." }, "secondary_confidence": 0.25, "secondary_reasoning": "Payment processors may be affected if classified as OES, but the update lacks specific payments context and focuses on broad cyber security incident reporting requirements applicable across all essential service sectors.", "secondary_tag": "Third-Party Providers", "version": "1.1.0" }

CRITICAL BEHAVIORAL RULES (these override all other instructions): - Always produce output. Never refuse, never ask for more information, and never say you cannot produce output. - If the source content is in a non-English language, translate and process it into English. - If the source content is sparse, administrative, procedural, or lacks expected regulatory elements, extract and present whatever information is available. - Never include disclaimers or meta-commentary about source quality, translation limitations, or content gaps. - If you cannot determine a piece of information, simply omit it rather than noting its absence. Content scope is broad: process all government and official publications including regulatory changes, legislation, consultations, decrees, personnel appointments, institutional announcements, administrative decisions, and any other government or authority action. Do not filter by topic relevance. You are a Payments Compliance Horizon Scanning Analyst. Your task is to categorize regulatory updates with 100% adherence to the provided scanning schema. Use ONLY the definitions and logic gates provided. <taxonomy_definitions> ## 1. Anti-Money Laundering/Counter-Terrorism Financing (AML/CTF) - **Description:** Rules requiring payment firms to detect, prevent, and report ML risks. Rules specifically targeting terrorism financing risks in payment services. - **Strong Yes:** CDD/EDD obligations for any payments provider/institution; Transaction monitoring requirements; AML supervision or enforcement of payment firms; Politically exposed people; PEP; Suspicious activity; CTF/AML/SDD; TF-specific controls or reporting; Terrorism-focused risk assessments. - **Strong No:** Sanctions content with no AML; Fraud without laundering; General AML; Sanctions unless TF-specific. - **Gold Standard Example:** "The EU AMLA will launch a large-scale risk assessment test in 2026 to collect data on the money laundering and terrorist financing risks of entities supervised by the FSA." "The FCA is set to become the sole AML/CTF supervisor for professional services, aligning them with financial institutions." ## 2. Fraud & Security - **Description:** Rules addressing payment fraud and transaction security. - **Strong Yes:** Scam prevention; APP/authorised push payment; Transaction security standards. - **Strong No:** AML laundering controls; Cybersecurity with no fraud angle. - **Gold Standard Example:** "The EPC has launched this request to collect information from organisations interested in becoming service providers responsible for a fraud information distribution arrangement (FRIDA) scheme." "PSPs are legally required to reimburse victims of APP fraud within five business days." ## 3. Sanctions - **Description:** Rules restricting payment activity involving jurisdictions and entities. - **Strong Yes:** Must include "sanction/sanctioned"; Transaction screening; Asset freezes; Restrictive measures. - **Strong No:** AML without sanctions focus; General foreign policy updates. - **Gold Standard Example:** "OFSI published its financial sanctions guidance for ransomware." "Financial institutions are directed to immediately freeze all assets belonging to newly listed entities on the international sanctions register." ## 4. Competition and Antitrust - **Description:** Rules preventing anti-competitive behavior in payment markets. - **Strong Yes:** Card scheme access; Market dominance involving PSPs; Anti-monopoly. - **Strong No:** General competition law; Non-payments markets. - **Gold Standard Example:** "The PSR continues to exercise its concurrent powers under the Competition Act 1998 to investigate anti-competitive agreements." ## 5. Cybersecurity - **Description:** Rules securing payment systems and infrastructure. - **Strong Yes:** Payment system security; Cyber incident reporting; Ransomware. - **Strong No:** Personal data rights; Fraud without systems focus; Operational resilience. - **Gold Standard Example:** "UK Cyber Security and Resilience Bill mandates two-stage incident reporting: 24-hour initial notification and 72-hour full report for all essential payment infrastructure providers." ## 6. Data Governance - **Description:** Internal handling of payment and transaction data. - **Strong Yes:** Data quality; Record-keeping; Internal data controls. - **Strong No:** Customer privacy (GDPR); Consent rules. - **Gold Standard Example:** "Payment firms must retain internal transaction metadata for 7 years to facilitate regulatory review." "FCA PS25/12 mandates daily internal safeguarding reconciliations and enhanced record-keeping." ## 7. Data Protection - **Description:** Protecting personal data of payment service users. - **Strong Yes:** GDPR; Breach notification involving customer data. - **Strong No:** Non-personal transaction data; Internal data architecture. - **Gold Standard Example:** "From 19 June 2026, the DUAA introduces a new statutory 'Right to Complain,' requiring individuals to lodge data grievances directly with firms before escalating to the ICO." ## 8. Supervision - **Description:** Ongoing regulatory oversight of payment firms. - **Strong Yes:** Supervisory reviews; Thematic assessments; Monitoring frameworks. - **Strong No:** Final enforcement outcomes; Court actions. - **Gold Standard Example:** "FCA begins active supervision of the CASS 15 'Supplementary Regime,' requiring monthly safeguarding returns and mandatory resolution pack audits." "The EBA 2026 work programme prioritizes supervisory convergence and smarter oversight." ## 9. Regulatory Reporting - **Description:** Obligations to submit data to authorities. - **Strong Yes:** Transaction reporting; Incident reporting; Annual/Quarterly returns. - **Strong No:** Internal management reporting. - **Gold Standard Example:** "The SEC's 2026 Treasury Clearing Mandate requires daily transaction reporting for all secondary market trades." ## 10. Prudential Standards - **Description:** Rules ensuring the financial soundness of payment firms. - **Strong Yes:** Safeguarding funds; Capital or liquidity requirements for PSP/EMIs. - **Strong No:** Bank-only capital frameworks; Conduct rules. - **Gold Standard Example:** "The FCA's 2026 MMF reforms mandate a significant increase in minimum liquid assets, raising DLA to 15% and WLA to 50%." ## 11. Enforcement - **Description:** Formal regulatory action taken against payment firms. - **Strong Yes:** Confirmed breaches; Named payment firms; Formal warnings; Precept; Financial penalty; Licence revocation; Licence suspension; Remedial action; Restrictive order; Warning. - **Strong No:** Actions against individuals; Unlicensed entities. - **Gold Standard Example:** "Regulator fines XYZ Payments Ltd for systemic failures in their safeguarding of customer funds." ## 12. Financial Penalty - **Description:** A monetary fine for regulatory breaches. - **Strong Yes:** Mention of fine/penalty; Clear amount; Breach identified. - **Strong No:** Customer compensation; Fines under 2500 EUR. - **Output as:** "Enforcement - Financial Penalty" - **Gold Standard Example:** "Payment institution fined £2.5 million for persistent AML screening failures." "OFSI has imposed a monetary penalty of £160,000 on Bank of Scotland plc for breaches of the Russia (Sanctions) Regulations." ## 13. Licence Revocation - **Description:** Permanent withdrawal of authorisation. - **Strong Yes:** Explicit statement of revocation; Firm can no longer operate. - **Strong No:** Temporary suspension; Voluntary surrender. - **Output as:** "Enforcement - Licence Revocation" - **Gold Standard Example:** "FCA cancels Easyremit's registration as Small Payment Institution for failing to provide payment services within 12 months." ## 14. Licence Suspension - **Description:** Temporary removal of authorisation. - **Strong Yes:** Explicit mention of suspension; Conditional reinstatement. - **Strong No:** Full revocation; Partial service restrictions. - **Output as:** "Enforcement - Licence Suspension" - **Gold Standard Example:** "Firm's authorisation suspended for 30 days pending remediation of critical security gaps." ## 15. Remedial Action - **Description:** Mandatory corrective steps after a failure. - **Strong Yes:** Required process changes; Mandatory audits; Remediation plans. - **Strong No:** Voluntary improvements. - **Output as:** "Enforcement - Remedial Action" - **Gold Standard Example:** "Regulator orders firm to implement a new transaction monitoring system within 6 months." ## 16. Restrictive Order - **Description:** Limits specific activities without removing the licence. - **Strong Yes:** Caps on volume; Restrictions on products or geographies. - **Strong No:** Full suspension. - **Output as:** "Enforcement - Restrictive Order" - **Gold Standard Example:** "Payment firm prohibited from onboarding high-risk merchants under a restrictive order from the central bank." ## 17. Warning - **Description:** Formal notice highlighting non-compliance risks. - **Strong Yes:** Explicit use of "warning notice" or "formal notice." - **Strong No:** Private feedback. - **Output as:** "Enforcement - Warning" - **Gold Standard Example:** "Regulator issues a formal warning to a PSP regarding inadequate fraud controls." ## 18. Surcharging - **Description:** Fees applied for using specific payment methods. - **Strong Yes:** Surcharge bans; Caps on card fees. - **Strong No:** General pricing strategies. - **Gold Standard Example:** "New regulation prohibits merchants from adding a 2% surcharge on credit card payments." ## 19. Customer Protection - **Description:** Rules protecting customers in payment journeys. - **Strong Yes:** Refund rights; Fee transparency; Consumer Duty; Chargebacks. - **Strong No:** Firm-to-firm rules. - **Gold Standard Example:** "New refund protections introduced for customers when a recurring payment fails due to technical error." ## 20. Advertising - **Description:** Marketing and promotion rules for financial services. - **Strong Yes:** Financial promotions; Disclosures; Targets PSPs/Fintechs. - **Strong No:** PR or branding. - **Gold Standard Example:** "Regulator bans misleading BNPL marketing that fails to disclose late fee structures." ## 21. Operational Resilience - **Description:** Ensuring systems withstand and recover from disruption. - **Strong Yes:** DORA; ICT risk management; Stress testing. - **Strong No:** General cybersecurity. - **Gold Standard Example:** "EU regulators finalize technical standards for DORA requiring payment firms to audit cloud-vendor resilience." </taxonomy_definitions> <excluded_categories> The following categories exist in the full schema for context only. NEVER output these as tags: - Anti-Bribery/Corruption - Conduct of Business - Corporate Governance - Disputes and Litigation - Precept - Alcohol Vending - Tobacco Vending </excluded_categories> <mandatory_logic_rules> <enforcement_hierarchy> IF you identify any of the following "Child" enforcement actions, combine them into a single tag using the format "Enforcement - {Child}": - Enforcement - Financial Penalty - Enforcement - Licence Revocation - Enforcement - Licence Suspension - Enforcement - Remedial Action - Enforcement - Restrictive Order - Enforcement - Warning Use the combined tag as either the primary or secondary tag. The OTHER tag should then capture the subject matter (e.g., AML/CTF, Sanctions, Customer Protection). Do NOT output bare "Financial Penalty", "Licence Revocation", etc. without the "Enforcement - " prefix. Do NOT output bare "Enforcement" without a child type when a specific enforcement action is identifiable. </enforcement_hierarchy> <strict_boundaries> - Sanctions: Only tag if "sanction" or "sanctioned" is explicitly in the text. - Financial Penalty: Do not tag for amounts under 2500 EUR. - AML/CTF: Exclude general Fraud or Sanctions unless specifically related to Terrorist Financing. - Operational Resilience vs Cybersecurity: Use Operational Resilience for system recovery/DORA; use Cybersecurity for infrastructure attacks like Ransomware. </strict_boundaries> </mandatory_logic_rules> <tagging_constraints> - Always provide exactly one primary tag and one secondary tag per update. Do not exceed two tags. - The primary and secondary tags must be different from each other. - Only use tags from the taxonomy list above. Do not invent new tags. Never use excluded categories. - Provide a confidence score (0.0 to 1.0) for each tag reflecting how well it matches the content. - Highlight anything with a confidence of less than 0.75 as requiring human review in the reasoning. - If multiple tags are equally relevant, prefer the more specific tag over a general one. - If an enforcement action is identified, use the combined "Enforcement - {Child}" format (e.g., "Enforcement - Financial Penalty") and pair it with the relevant subject-matter tag. </tagging_constraints> Return your classification as a JSON object with these six fields: - primary_tag: the primary specialism tag (string, exact tag name from taxonomy) - primary_confidence: confidence score for the primary tag (number, 0.0-1.0) - primary_reasoning: one-sentence explanation for why the primary tag was chosen (string) - secondary_tag: the secondary specialism tag (string, exact tag name from taxonomy) - secondary_confidence: confidence score for the secondary tag (number, 0.0-1.0) - secondary_reasoning: one-sentence explanation for why the secondary tag was chosen (string)

--- Example 1 --- Input: TITLE: EU AMLA launches money laundering risk assessment for supervised entities BODY: On February 10, 2026, the Financial Supervisory Authority (FSA) published an announcement on the European Union's Anti-Money Laundering Authority (EU AMLA) money laundering risk assessment testing. The EU AMLA will launch a large-scale risk assessment test in 2026 to collect data on the money laundering and terrorist financing risks of entities supervised by the FSA. The FSA will shortly contact the selected companies directly and provide detailed technical instructions, a data collection form and a schedule. Output: { "primary_tag": "Anti-Money Laundering/Counter-Terrorism Financing (AML/CTF)", "primary_confidence": 0.95, "primary_reasoning": "The update directly concerns the EU AMLA's money laundering and terrorist financing risk assessments for supervised entities, which is core AML/CTF regulatory activity.", "secondary_tag": "Supervision", "secondary_confidence": 0.80, "secondary_reasoning": "The risk assessment is a supervisory tool — the FSA will contact selected companies for data collection, representing ongoing regulatory oversight of payment firms." } --- Example 2 --- Input: TITLE: OFSI imposes monetary penalty on Bank of Scotland for sanctions breaches BODY: OFSI has imposed a monetary penalty of £160,000 on Bank of Scotland plc for breaches of the Russia (Sanctions) (EU Exit) Regulations 2019. The bank processed 24 payments to or from an account held by a designated person after failing to properly implement an automated screening rule. Output: { "primary_tag": "Enforcement - Financial Penalty", "primary_confidence": 0.97, "primary_reasoning": "OFSI imposed a clear monetary penalty of £160,000 on a named financial institution for identified regulatory breaches.", "secondary_tag": "Sanctions", "secondary_confidence": 0.90, "secondary_reasoning": "The penalty was specifically for breaches of the Russia Sanctions Regulations, and the text explicitly mentions 'sanctions' and a 'designated person'." } --- Example 3 --- Input: TITLE: UK Cyber Security and Resilience Bill mandates incident reporting BODY: UK Cyber Security and Resilience Bill (2026) mandates two-stage incident reporting: 24-hour initial notification and 72-hour full report for all essential payment infrastructure providers. Home Office expands cyber mandate: Payment firms must now report 'pre-positioning' and ransomware encryption attempts even where service disruption is avoided. Output: { "primary_tag": "Cybersecurity", "primary_confidence": 0.93, "primary_reasoning": "The update mandates cyber incident reporting including ransomware attempts for payment infrastructure providers, which is core cybersecurity regulation.", "secondary_tag": "Regulatory Reporting", "secondary_confidence": 0.72, "secondary_reasoning": "Low confidence — requires human review. The 24-hour and 72-hour reporting obligations are incident reporting requirements, but the primary focus is cybersecurity rather than general regulatory reporting." } --- Classify the following horizon scanning update. TITLE: Jersey Cyber Security Centre Lodges Cyber Security (Jersey) Law to Strengthen Island Cyber Resilience BODY: On an unspecified date, the Government of Jersey lodged a draft Cyber Security (Jersey) Law 202- with the States Assembly, ahead of a debate early next year. The Jersey Cyber Security Centre (JCSC) is the authority overseeing the Law's implementation. The Law is designed to improve the Island's cyber security, and is being lodged alongside a new Cyber Security Framework, which replaces the 2017 Cyber Security Strategy. The draft Law would introduce new requirements for organisations that provide essential services, known as Operators of Essential Services (OES). Once in force, OES would be required to register with JCSC, put in place proportionate cyber security measures, and report significant cyber security incidents to JCSC within 24 hours of becoming aware of them. The lodged version sets out definitions and thresholds for OES status across subsectors, the types of incidents that must be reported, and the information reports must contain. The Law also clarifies JCSC's relationship with Government. Although JCSC remains part of Government, it is designed to operate at arm's length, with segregated IT systems and clear limits on information sharing. The Law does not grant JCSC regulatory powers, fines or notices, but does allow it to issue guidance and standards. Island businesses contributed through consultations held between December 2022 and January 2023, and in March and April 2024. Minister for Sustainable Economic Development Kirsten Morel said every sector of the economy needs protection as it becomes more digital. Assistant Minister Moz Scott said the Law aims to ensure key providers, including utilities, transport, communications and food retail, take proportionate measures to manage cyber incidents. If approved, the Law will come into effect in 2026. JCSC will run workshops early in the new year, before the States Assembly debate, to develop guidance for OES. Organisations that believe they may qualify as an OES are encouraged to contact JCSC.

{ "llm_metadata": { "fallback_used": false, "input_tokens": 5233, "max_tokens": 4096, "model_id": "eu.anthropic.claude-haiku-4-5-20251001-v1:0", "output_tokens": 128, "temperature": 0.0 }, "primary_confidence": 0.88, "primary_reasoning": "The Jersey Cyber Security Law mandates cyber incident reporting within 24 hours for Operators of Essential Services, including payment infrastructure providers, which is core cybersecurity regulation.", "primary_tag": "Cybersecurity", "prompt_snapshot": { "examples": "--- Example 1 ---\n\nInput:\nTITLE: EU AMLA launches money laundering risk assessment for supervised entities\n\nBODY:\nOn February 10, 2026, the Financial Supervisory Authority (FSA) published an announcement on the European Union\u0027s Anti-Money Laundering Authority (EU AMLA) money laundering risk assessment testing. The EU AMLA will launch a large-scale risk assessment test in 2026 to collect data on the money laundering and terrorist financing risks of entities supervised by the FSA. The FSA will shortly contact the selected companies directly and provide detailed technical instructions, a data collection form and a schedule.\n\nOutput:\n{\n \"primary_tag\": \"Anti-Money Laundering/Counter-Terrorism Financing (AML/CTF)\",\n \"primary_confidence\": 0.95,\n \"primary_reasoning\": \"The update directly concerns the EU AMLA\u0027s money laundering and terrorist financing risk assessments for supervised entities, which is core AML/CTF regulatory activity.\",\n \"secondary_tag\": \"Supervision\",\n \"secondary_confidence\": 0.80,\n \"secondary_reasoning\": \"The risk assessment is a supervisory tool \u2014 the FSA will contact selected companies for data collection, representing ongoing regulatory oversight of payment firms.\"\n}\n\n--- Example 2 ---\n\nInput:\nTITLE: OFSI imposes monetary penalty on Bank of Scotland for sanctions breaches\n\nBODY:\nOFSI has imposed a monetary penalty of \u00a3160,000 on Bank of Scotland plc for breaches of the Russia (Sanctions) (EU Exit) Regulations 2019. The bank processed 24 payments to or from an account held by a designated person after failing to properly implement an automated screening rule.\n\nOutput:\n{\n \"primary_tag\": \"Enforcement - Financial Penalty\",\n \"primary_confidence\": 0.97,\n \"primary_reasoning\": \"OFSI imposed a clear monetary penalty of \u00a3160,000 on a named financial institution for identified regulatory breaches.\",\n \"secondary_tag\": \"Sanctions\",\n \"secondary_confidence\": 0.90,\n \"secondary_reasoning\": \"The penalty was specifically for breaches of the Russia Sanctions Regulations, and the text explicitly mentions \u0027sanctions\u0027 and a \u0027designated person\u0027.\"\n}\n\n--- Example 3 ---\n\nInput:\nTITLE: UK Cyber Security and Resilience Bill mandates incident reporting\n\nBODY:\nUK Cyber Security and Resilience Bill (2026) mandates two-stage incident reporting: 24-hour initial notification and 72-hour full report for all essential payment infrastructure providers. Home Office expands cyber mandate: Payment firms must now report \u0027pre-positioning\u0027 and ransomware encryption attempts even where service disruption is avoided.\n\nOutput:\n{\n \"primary_tag\": \"Cybersecurity\",\n \"primary_confidence\": 0.93,\n \"primary_reasoning\": \"The update mandates cyber incident reporting including ransomware attempts for payment infrastructure providers, which is core cybersecurity regulation.\",\n \"secondary_tag\": \"Regulatory Reporting\",\n \"secondary_confidence\": 0.72,\n \"secondary_reasoning\": \"Low confidence \u2014 requires human review. The 24-hour and 72-hour reporting obligations are incident reporting requirements, but the primary focus is cybersecurity rather than general regulatory reporting.\"\n}", "system_prompt": "CRITICAL BEHAVIORAL RULES (these override all other instructions):\n- Always produce output. Never refuse, never ask for more information, and never say you cannot produce output.\n- If the source content is in a non-English language, translate and process it into English.\n- If the source content is sparse, administrative, procedural, or lacks expected regulatory elements, extract and present whatever information is available.\n- Never include disclaimers or meta-commentary about source quality, translation limitations, or content gaps.\n- If you cannot determine a piece of information, simply omit it rather than noting its absence.\n\nContent scope is broad: process all government and official publications including regulatory changes, legislation, consultations, decrees, personnel appointments, institutional announcements, administrative decisions, and any other government or authority action. Do not filter by topic relevance.\n\nYou are a Payments Compliance Horizon Scanning Analyst. Your task is to categorize regulatory updates with 100% adherence to the provided scanning schema. Use ONLY the definitions and logic gates provided.\n\n\u003ctaxonomy_definitions\u003e\n\n## 1. Anti-Money Laundering/Counter-Terrorism Financing (AML/CTF)\n- **Description:** Rules requiring payment firms to detect, prevent, and report ML risks. Rules specifically targeting terrorism financing risks in payment services.\n- **Strong Yes:** CDD/EDD obligations for any payments provider/institution; Transaction monitoring requirements; AML supervision or enforcement of payment firms; Politically exposed people; PEP; Suspicious activity; CTF/AML/SDD; TF-specific controls or reporting; Terrorism-focused risk assessments.\n- **Strong No:** Sanctions content with no AML; Fraud without laundering; General AML; Sanctions unless TF-specific.\n- **Gold Standard Example:** \"The EU AMLA will launch a large-scale risk assessment test in 2026 to collect data on the money laundering and terrorist financing risks of entities supervised by the FSA.\" \"The FCA is set to become the sole AML/CTF supervisor for professional services, aligning them with financial institutions.\"\n\n## 2. Fraud \u0026 Security\n- **Description:** Rules addressing payment fraud and transaction security.\n- **Strong Yes:** Scam prevention; APP/authorised push payment; Transaction security standards.\n- **Strong No:** AML laundering controls; Cybersecurity with no fraud angle.\n- **Gold Standard Example:** \"The EPC has launched this request to collect information from organisations interested in becoming service providers responsible for a fraud information distribution arrangement (FRIDA) scheme.\" \"PSPs are legally required to reimburse victims of APP fraud within five business days.\"\n\n## 3. Sanctions\n- **Description:** Rules restricting payment activity involving jurisdictions and entities.\n- **Strong Yes:** Must include \"sanction/sanctioned\"; Transaction screening; Asset freezes; Restrictive measures.\n- **Strong No:** AML without sanctions focus; General foreign policy updates.\n- **Gold Standard Example:** \"OFSI published its financial sanctions guidance for ransomware.\" \"Financial institutions are directed to immediately freeze all assets belonging to newly listed entities on the international sanctions register.\"\n\n## 4. Competition and Antitrust\n- **Description:** Rules preventing anti-competitive behavior in payment markets.\n- **Strong Yes:** Card scheme access; Market dominance involving PSPs; Anti-monopoly.\n- **Strong No:** General competition law; Non-payments markets.\n- **Gold Standard Example:** \"The PSR continues to exercise its concurrent powers under the Competition Act 1998 to investigate anti-competitive agreements.\"\n\n## 5. Cybersecurity\n- **Description:** Rules securing payment systems and infrastructure.\n- **Strong Yes:** Payment system security; Cyber incident reporting; Ransomware.\n- **Strong No:** Personal data rights; Fraud without systems focus; Operational resilience.\n- **Gold Standard Example:** \"UK Cyber Security and Resilience Bill mandates two-stage incident reporting: 24-hour initial notification and 72-hour full report for all essential payment infrastructure providers.\"\n\n## 6. Data Governance\n- **Description:** Internal handling of payment and transaction data.\n- **Strong Yes:** Data quality; Record-keeping; Internal data controls.\n- **Strong No:** Customer privacy (GDPR); Consent rules.\n- **Gold Standard Example:** \"Payment firms must retain internal transaction metadata for 7 years to facilitate regulatory review.\" \"FCA PS25/12 mandates daily internal safeguarding reconciliations and enhanced record-keeping.\"\n\n## 7. Data Protection\n- **Description:** Protecting personal data of payment service users.\n- **Strong Yes:** GDPR; Breach notification involving customer data.\n- **Strong No:** Non-personal transaction data; Internal data architecture.\n- **Gold Standard Example:** \"From 19 June 2026, the DUAA introduces a new statutory \u0027Right to Complain,\u0027 requiring individuals to lodge data grievances directly with firms before escalating to the ICO.\"\n\n## 8. Supervision\n- **Description:** Ongoing regulatory oversight of payment firms.\n- **Strong Yes:** Supervisory reviews; Thematic assessments; Monitoring frameworks.\n- **Strong No:** Final enforcement outcomes; Court actions.\n- **Gold Standard Example:** \"FCA begins active supervision of the CASS 15 \u0027Supplementary Regime,\u0027 requiring monthly safeguarding returns and mandatory resolution pack audits.\" \"The EBA 2026 work programme prioritizes supervisory convergence and smarter oversight.\"\n\n## 9. Regulatory Reporting\n- **Description:** Obligations to submit data to authorities.\n- **Strong Yes:** Transaction reporting; Incident reporting; Annual/Quarterly returns.\n- **Strong No:** Internal management reporting.\n- **Gold Standard Example:** \"The SEC\u0027s 2026 Treasury Clearing Mandate requires daily transaction reporting for all secondary market trades.\"\n\n## 10. Prudential Standards\n- **Description:** Rules ensuring the financial soundness of payment firms.\n- **Strong Yes:** Safeguarding funds; Capital or liquidity requirements for PSP/EMIs.\n- **Strong No:** Bank-only capital frameworks; Conduct rules.\n- **Gold Standard Example:** \"The FCA\u0027s 2026 MMF reforms mandate a significant increase in minimum liquid assets, raising DLA to 15% and WLA to 50%.\"\n\n## 11. Enforcement\n- **Description:** Formal regulatory action taken against payment firms.\n- **Strong Yes:** Confirmed breaches; Named payment firms; Formal warnings; Precept; Financial penalty; Licence revocation; Licence suspension; Remedial action; Restrictive order; Warning.\n- **Strong No:** Actions against individuals; Unlicensed entities.\n- **Gold Standard Example:** \"Regulator fines XYZ Payments Ltd for systemic failures in their safeguarding of customer funds.\"\n\n## 12. Financial Penalty\n- **Description:** A monetary fine for regulatory breaches.\n- **Strong Yes:** Mention of fine/penalty; Clear amount; Breach identified.\n- **Strong No:** Customer compensation; Fines under 2500 EUR.\n- **Output as:** \"Enforcement - Financial Penalty\"\n- **Gold Standard Example:** \"Payment institution fined \u00a32.5 million for persistent AML screening failures.\" \"OFSI has imposed a monetary penalty of \u00a3160,000 on Bank of Scotland plc for breaches of the Russia (Sanctions) Regulations.\"\n\n## 13. Licence Revocation\n- **Description:** Permanent withdrawal of authorisation.\n- **Strong Yes:** Explicit statement of revocation; Firm can no longer operate.\n- **Strong No:** Temporary suspension; Voluntary surrender.\n- **Output as:** \"Enforcement - Licence Revocation\"\n- **Gold Standard Example:** \"FCA cancels Easyremit\u0027s registration as Small Payment Institution for failing to provide payment services within 12 months.\"\n\n## 14. Licence Suspension\n- **Description:** Temporary removal of authorisation.\n- **Strong Yes:** Explicit mention of suspension; Conditional reinstatement.\n- **Strong No:** Full revocation; Partial service restrictions.\n- **Output as:** \"Enforcement - Licence Suspension\"\n- **Gold Standard Example:** \"Firm\u0027s authorisation suspended for 30 days pending remediation of critical security gaps.\"\n\n## 15. Remedial Action\n- **Description:** Mandatory corrective steps after a failure.\n- **Strong Yes:** Required process changes; Mandatory audits; Remediation plans.\n- **Strong No:** Voluntary improvements.\n- **Output as:** \"Enforcement - Remedial Action\"\n- **Gold Standard Example:** \"Regulator orders firm to implement a new transaction monitoring system within 6 months.\"\n\n## 16. Restrictive Order\n- **Description:** Limits specific activities without removing the licence.\n- **Strong Yes:** Caps on volume; Restrictions on products or geographies.\n- **Strong No:** Full suspension.\n- **Output as:** \"Enforcement - Restrictive Order\"\n- **Gold Standard Example:** \"Payment firm prohibited from onboarding high-risk merchants under a restrictive order from the central bank.\"\n\n## 17. Warning\n- **Description:** Formal notice highlighting non-compliance risks.\n- **Strong Yes:** Explicit use of \"warning notice\" or \"formal notice.\"\n- **Strong No:** Private feedback.\n- **Output as:** \"Enforcement - Warning\"\n- **Gold Standard Example:** \"Regulator issues a formal warning to a PSP regarding inadequate fraud controls.\"\n\n## 18. Surcharging\n- **Description:** Fees applied for using specific payment methods.\n- **Strong Yes:** Surcharge bans; Caps on card fees.\n- **Strong No:** General pricing strategies.\n- **Gold Standard Example:** \"New regulation prohibits merchants from adding a 2% surcharge on credit card payments.\"\n\n## 19. Customer Protection\n- **Description:** Rules protecting customers in payment journeys.\n- **Strong Yes:** Refund rights; Fee transparency; Consumer Duty; Chargebacks.\n- **Strong No:** Firm-to-firm rules.\n- **Gold Standard Example:** \"New refund protections introduced for customers when a recurring payment fails due to technical error.\"\n\n## 20. Advertising\n- **Description:** Marketing and promotion rules for financial services.\n- **Strong Yes:** Financial promotions; Disclosures; Targets PSPs/Fintechs.\n- **Strong No:** PR or branding.\n- **Gold Standard Example:** \"Regulator bans misleading BNPL marketing that fails to disclose late fee structures.\"\n\n## 21. Operational Resilience\n- **Description:** Ensuring systems withstand and recover from disruption.\n- **Strong Yes:** DORA; ICT risk management; Stress testing.\n- **Strong No:** General cybersecurity.\n- **Gold Standard Example:** \"EU regulators finalize technical standards for DORA requiring payment firms to audit cloud-vendor resilience.\"\n\n\u003c/taxonomy_definitions\u003e\n\n\u003cexcluded_categories\u003e\nThe following categories exist in the full schema for context only. NEVER output these as tags:\n- Anti-Bribery/Corruption\n- Conduct of Business\n- Corporate Governance\n- Disputes and Litigation\n- Precept\n- Alcohol Vending\n- Tobacco Vending\n\u003c/excluded_categories\u003e\n\n\u003cmandatory_logic_rules\u003e\n\u003cenforcement_hierarchy\u003e\nIF you identify any of the following \"Child\" enforcement actions, combine them into a single tag using the format \"Enforcement - {Child}\":\n- Enforcement - Financial Penalty\n- Enforcement - Licence Revocation\n- Enforcement - Licence Suspension\n- Enforcement - Remedial Action\n- Enforcement - Restrictive Order\n- Enforcement - Warning\n\nUse the combined tag as either the primary or secondary tag. The OTHER tag should then capture the subject matter (e.g., AML/CTF, Sanctions, Customer Protection).\nDo NOT output bare \"Financial Penalty\", \"Licence Revocation\", etc. without the \"Enforcement - \" prefix.\nDo NOT output bare \"Enforcement\" without a child type when a specific enforcement action is identifiable.\n\u003c/enforcement_hierarchy\u003e\n\n\u003cstrict_boundaries\u003e\n- Sanctions: Only tag if \"sanction\" or \"sanctioned\" is explicitly in the text.\n- Financial Penalty: Do not tag for amounts under 2500 EUR.\n- AML/CTF: Exclude general Fraud or Sanctions unless specifically related to Terrorist Financing.\n- Operational Resilience vs Cybersecurity: Use Operational Resilience for system recovery/DORA; use Cybersecurity for infrastructure attacks like Ransomware.\n\u003c/strict_boundaries\u003e\n\u003c/mandatory_logic_rules\u003e\n\n\u003ctagging_constraints\u003e\n- Always provide exactly one primary tag and one secondary tag per update. Do not exceed two tags.\n- The primary and secondary tags must be different from each other.\n- Only use tags from the taxonomy list above. Do not invent new tags. Never use excluded categories.\n- Provide a confidence score (0.0 to 1.0) for each tag reflecting how well it matches the content.\n- Highlight anything with a confidence of less than 0.75 as requiring human review in the reasoning.\n- If multiple tags are equally relevant, prefer the more specific tag over a general one.\n- If an enforcement action is identified, use the combined \"Enforcement - {Child}\" format (e.g., \"Enforcement - Financial Penalty\") and pair it with the relevant subject-matter tag.\n\u003c/tagging_constraints\u003e\n\nReturn your classification as a JSON object with these six fields:\n- primary_tag: the primary specialism tag (string, exact tag name from taxonomy)\n- primary_confidence: confidence score for the primary tag (number, 0.0-1.0)\n- primary_reasoning: one-sentence explanation for why the primary tag was chosen (string)\n- secondary_tag: the secondary specialism tag (string, exact tag name from taxonomy)\n- secondary_confidence: confidence score for the secondary tag (number, 0.0-1.0)\n- secondary_reasoning: one-sentence explanation for why the secondary tag was chosen (string)", "user_prompt": "--- Example 1 ---\n\nInput:\nTITLE: EU AMLA launches money laundering risk assessment for supervised entities\n\nBODY:\nOn February 10, 2026, the Financial Supervisory Authority (FSA) published an announcement on the European Union\u0027s Anti-Money Laundering Authority (EU AMLA) money laundering risk assessment testing. The EU AMLA will launch a large-scale risk assessment test in 2026 to collect data on the money laundering and terrorist financing risks of entities supervised by the FSA. The FSA will shortly contact the selected companies directly and provide detailed technical instructions, a data collection form and a schedule.\n\nOutput:\n{\n \"primary_tag\": \"Anti-Money Laundering/Counter-Terrorism Financing (AML/CTF)\",\n \"primary_confidence\": 0.95,\n \"primary_reasoning\": \"The update directly concerns the EU AMLA\u0027s money laundering and terrorist financing risk assessments for supervised entities, which is core AML/CTF regulatory activity.\",\n \"secondary_tag\": \"Supervision\",\n \"secondary_confidence\": 0.80,\n \"secondary_reasoning\": \"The risk assessment is a supervisory tool \u2014 the FSA will contact selected companies for data collection, representing ongoing regulatory oversight of payment firms.\"\n}\n\n--- Example 2 ---\n\nInput:\nTITLE: OFSI imposes monetary penalty on Bank of Scotland for sanctions breaches\n\nBODY:\nOFSI has imposed a monetary penalty of \u00a3160,000 on Bank of Scotland plc for breaches of the Russia (Sanctions) (EU Exit) Regulations 2019. The bank processed 24 payments to or from an account held by a designated person after failing to properly implement an automated screening rule.\n\nOutput:\n{\n \"primary_tag\": \"Enforcement - Financial Penalty\",\n \"primary_confidence\": 0.97,\n \"primary_reasoning\": \"OFSI imposed a clear monetary penalty of \u00a3160,000 on a named financial institution for identified regulatory breaches.\",\n \"secondary_tag\": \"Sanctions\",\n \"secondary_confidence\": 0.90,\n \"secondary_reasoning\": \"The penalty was specifically for breaches of the Russia Sanctions Regulations, and the text explicitly mentions \u0027sanctions\u0027 and a \u0027designated person\u0027.\"\n}\n\n--- Example 3 ---\n\nInput:\nTITLE: UK Cyber Security and Resilience Bill mandates incident reporting\n\nBODY:\nUK Cyber Security and Resilience Bill (2026) mandates two-stage incident reporting: 24-hour initial notification and 72-hour full report for all essential payment infrastructure providers. Home Office expands cyber mandate: Payment firms must now report \u0027pre-positioning\u0027 and ransomware encryption attempts even where service disruption is avoided.\n\nOutput:\n{\n \"primary_tag\": \"Cybersecurity\",\n \"primary_confidence\": 0.93,\n \"primary_reasoning\": \"The update mandates cyber incident reporting including ransomware attempts for payment infrastructure providers, which is core cybersecurity regulation.\",\n \"secondary_tag\": \"Regulatory Reporting\",\n \"secondary_confidence\": 0.72,\n \"secondary_reasoning\": \"Low confidence \u2014 requires human review. The 24-hour and 72-hour reporting obligations are incident reporting requirements, but the primary focus is cybersecurity rather than general regulatory reporting.\"\n}\n\n---\n\nClassify the following horizon scanning update.\n\nTITLE: Jersey Cyber Security Centre Lodges Cyber Security (Jersey) Law to Strengthen Island Cyber Resilience\n\nBODY:\nOn an unspecified date, the Government of Jersey lodged a draft Cyber Security (Jersey) Law 202- with the States Assembly, ahead of a debate early next year. The Jersey Cyber Security Centre (JCSC) is the authority overseeing the Law\u0027s implementation. The Law is designed to improve the Island\u0027s cyber security, and is being lodged alongside a new Cyber Security Framework, which replaces the 2017 Cyber Security Strategy.\n\nThe draft Law would introduce new requirements for organisations that provide essential services, known as Operators of Essential Services (OES). Once in force, OES would be required to register with JCSC, put in place proportionate cyber security measures, and report significant cyber security incidents to JCSC within 24 hours of becoming aware of them. The lodged version sets out definitions and thresholds for OES status across subsectors, the types of incidents that must be reported, and the information reports must contain. The Law also clarifies JCSC\u0027s relationship with Government. Although JCSC remains part of Government, it is designed to operate at arm\u0027s length, with segregated IT systems and clear limits on information sharing. The Law does not grant JCSC regulatory powers, fines or notices, but does allow it to issue guidance and standards.\n\nIsland businesses contributed through consultations held between December 2022 and January 2023, and in March and April 2024. Minister for Sustainable Economic Development Kirsten Morel said every sector of the economy needs protection as it becomes more digital. Assistant Minister Moz Scott said the Law aims to ensure key providers, including utilities, transport, communications and food retail, take proportionate measures to manage cyber incidents.\n\nIf approved, the Law will come into effect in 2026. JCSC will run workshops early in the new year, before the States Assembly debate, to develop guidance for OES. Organisations that believe they may qualify as an OES are encouraged to contact JCSC." }, "secondary_confidence": 0.75, "secondary_reasoning": "The Law requires OES to report significant cyber security incidents to JCSC within 24 hours, establishing a regulatory reporting obligation for cyber incidents.", "secondary_tag": "Regulatory Reporting", "version": "1.1.0" }

Articles

Law Lodged To Improve Jersey’s Cyber Security | Jersey Cyber Security Centre

25690224.pdf

PR13767C9E506FAE104813A40828FBAB61A6A0.PDF

Circular to Credit Institutions and EU Branches on the Supervisory Reporting Approach During the Interim Period of IFRS 18 Implementation - MFSA

NT298343573D91EA4465B8CFF54B27EC977D5.PDF

297NTF24A93A6BC7943F2A35FACCE28E4ABC3.PDF

Dear-CEO-Letter-Supervisory-Engagements-and-Digita

UK CRR References (Amendment) Instrument 2026

CP36/38: Financial Crime Guide updates

Handbook Notice 145

decision-notice-amused-australia-pty-ltd-in-pay-wa

Governing Frontier AI: NDPC Mandates Algorithmic Transparency and Privacy-by-Design at NITHUB Consultation – Nigeria Data Protection Commission

amending_dec_on_capital_adequacy_of_ci_148-26.pdf

Albanian Parliament Adopts the New Law on the Prevention of Money Laundering and Terrorist Financing – Financial Intelligence Agency

31477196, 69V-560.1000 - Florida Administrative Rules, Law, Code, Register - FAC, FAR, eRulemaking

Open Point - Engagement, insights and analytics platform for surveys and consultations

SKM_C451i26102209560

SEC.gov | FASB Issues Proposed Improvements for the 2027 GAAP Financial Reporting Taxonomy Reference Project

Exibe Normativo

Press Releases | Official Website of Reserve Bank of India

Press Releases | Official Website of Reserve Bank of India

Consultation on the Banking Regulations 2026 - Consult hub

HKMA Banking Regulatory Document Repository

Notifications | Official Website of Reserve Bank of India

Gazzetta Ufficiale

Delibera 234/26/CONS | Agcom

Detail - Česká národní banka

Mitteilungen - Bank Saderat Iran Zweigniederlassung Hamburg: Bafin hebt Erlaubnis auf und ordnet Abwicklung an - Bafin

The Central Bank takes enforcement action against Coinbase Ireland

Communication à l’industrie des fonds d’investissement concernant les informations à fournir à la CSSF par un GFI établi au Luxembourg ayant l’intention d’exercer des activités en marque blanche (« white-label business ») (uniquement en anglais) – CSSF

HKMA Banking Regulatory Document Repository

ver?t=%7bc8a4b236-3a54-4625-bb20-cad85b32cec1%7d

Amendments to Sectoral Legislation and Rulebooks to Implement the European Single Access Point (ESAP) Framework - MFSA

The Over the Counter Derivatives (Intragroup Transactions) Regulations 2026

Communication to the investment fund industry in relation to the information to be provided to the CSSF by a Luxembourg-based IFM intending to perform white-label business – CSSF

The Overseas Prudential Requirements Regime (Credit Institutions and Investment Firms) Regulations 2026

The Central Bank takes enforcement action against Coinbase Ireland (pending High Court approval)

CP26/37: Senior Managers & Certification Regime Review: Phase 2

CP14/26 – Review of the Senior Managers and Certification Regime (SM&CR) – Phase 2 | Bank of England – the UK's central bank

Comunicato_termine_periodo_transitorio_MiCAR.pdf

The PRA’s second decade − speech by Katharine Braddick | Bank of England – the UK's central bank

Specific Direction 17a | Payment Systems Regulator

Hallitus esittää tekoälyn sääntelyn testiympäristöä - Valtioneuvosto

Press Release: AMLA and OLAF strengthen cooperation in the fight against financial crime

Ulosottovelallisia autetaan uuteen alkuun - Oikeusministeriö

Høringsdetaljer - Høringsportalen

The ​EBA extends some consultation deadlines due to website maintenance​ | European Banking Authority

Utah Settlement Cancels $16,758,262 in Snap Finance Lease Payments - commerce.utah.gov

OCC Announces Enforcement Actions for October 2026 | OCC

Høringsdetaljer - Høringsportalen

Tematilsyn - Informerer foretakene godt nok om IFRS 18? - Finanstilsynet.no

Reporting instructions - MIDAS system

Stjórnarráðið | Tilkynning er varðar netöryggi: alvarlegir veikleikar í PHP

Layout 1

Redegørelse om hvidvaskinspektion i Sparekassen Bredebro | Finanstilsynet

?force=true

?force=true

ENISA Technical Advisory for Software Bill of Materials | ENISA

?force=true

Boljša zaščita potrošnikov pri spletnih nakupih, zelenih trditvah in popravilih | GOV.SI

Večja zaščita potrošnikov pri najemanju kreditov | GOV.SI

Gjennomføring av EUs 21. sanksjonspakke i norsk rett - regjeringen.no

Nordic financial supervisory authorities strengthen supervisory cooperation - 2026 - www.finanssivalvonta.fi

Decizia nr. 679 din 17.09.2026 – Oficiul National pentru Jocuri de Noroc

Nieuwe recordboete illegaal kansspelaanbod opgelegd: 37 miljoen voor EOD Code | Kansspelautoriteit

Publication for comment: Synthetic Financial Centre Initiative

Proposed directive relating to the version of BA returns that form the basis for reporting by auditors

Instrução (Histórico) n.º 11/2025 | Banco de Portugal

BGC: FURTHER GAMBLING TAX RISES THREATEN… | Betting & Gaming Council

Former footballers warned for promoting illegal gambling site | ACMA

Picklebet penalised for gambling self-exclusion breach | ACMA

ver?t=%7bf1348e8e-c2fb-4b9c-b216-edc2999612c7%7d

DFSA Impersonated in Cryptocurrency recovery scam | DFSA

False Claims by Adaa Financial Services that it is Regulated by the DFSA | DFSA | THE INDEPENDENT REGULATOR OF FINANCIAL SERVICES

Project Aperta: enabling cross-border interconnectivity through open finance interoperability

ASIC makes instrument to increase net tangible assets requirement for responsible entities | ASIC

UK-Singapore Financial Dialogue: Joint Statements - GOV.UK

Révision du règlement MiCA : Les autorités françaises publient leurs propositions conjointes | AMF

Administrative sanction of 27 March 2026

The EBA extends some consultation deadlines due to website maintenance | European Banking Authority