Published

On October 22, 2026, the Central Bank of Brazil (BCB), in conjunction with the National Monetary Council (CMN), issued Joint Resolution No. 21 , which amends existing rules to improve partnership agreements and the use of the open finance ecosystem by legal entities (i.e., corporate clients). According to a news release announcing the resolution, the amendments aim to clarify the scope of the open finance regime, reduce interpretation divergences among participants and strengthen responsibilities related to the security, privacy and governance of shared data. Specifically, the resolution introduces adjustments to open finance governance by reinforcing the responsibilities of the board of directors and administrative councils of participating institutions regarding regulatory compliance, monitoring and the adoption of preventive and corrective measures. Additionally, the resolution implements changes to enable future processes where consent for data access can occur at different times at both receiving and transmitting institutions. For corporate clients, this consent may be granted by different users; this flexibility is designed to expand convenience and encourage open finance usage by businesses by better aligning with their internal representation and approval processes. The resolution takes effect immediately .

On October 21, 2026, the US Office of Foreign Assets Control (OFAC) announced sanctions against supporters of Iran's shadow fleet as part of the US Department of the Treasury's broader "Operation Economic Outcast" campaign. OFAC designated Panama- and Greece-based law firm Karnakis and Karnakis, as well as Singapore- and United Arab Emirates (UAE)-based shipping agents and a fleet of cargo vessels, for supporting Iranian shadow fleet operations. As a result of the new designations, all property and interests of these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC. Concurrently, OFAC took the following actions: Issuing Iran-related General License GG , which authorizes the wind-down of transactions involving Karnkakis and Karnakis. Issuing Iran-related General License HH , which authorizes wind-down activities, limited safety and environmental transactions and the offloading of cargo involving newly blocked persons and vessels, Issuing Russia-related General License 131K , which authorizes certain transactions for the negotiation of and entry into contingent contracts for the sale of Lukoil International GmbH and related maintenance activities. Issuing two amended Russia-related frequently asked question (FAQ) documents: FAQ 1224 and FAQ 1225 .

On October 21, 2026, the US Office of the Comptroller of the Currency (OCC) issued a final rule implementing the Guiding and Establishing National Innovation for US Stablecoins (GENIUS) Act for the issuance of permitted payment stablecoins (PPSIs) and certain related activities by entities under the OCC's jurisdiction. The rule addresses all OCC supervisory duties required of it under the GENIUS Act, except those relating to the Bank Secrecy Act (BSA), anti-money laundering (AML) and US Office of Foreign Assets Control sanctions regulations, which will be addressed in a separate rulemaking by the US Department of the Treasury. The majority of the OCC's final rule is codified in a new 12 Code of Federal Regulations (CFR) Part 15 , covering: Permitted and prohibited stablecoin activities. Reserve asset composition. Redemption procedures. Risk management. Audits and supervision. Custody standards. Applications and registrations. Examination of foreign issuers. Revocation of approval. Capital and operational backstops. Additionally, the final rule amends capital adequacy standards under 12 CFR Part 3 , prompt corrective action rules under 12 CFR 6 , fee assessments under 12 CFR 8 and rules of practice under 12 CFR 19 . The final rule applies to national banks and their subsidiaries, federal savings associations and their subsidiaries, federal branches and their subsidiaries, foreign PPSIs, nonbank entities seeking or holding federally qualified PPSI status and state qualified PPSIs operating under the OCC's authority. The final rule takes effect on January 18, 2027 , the same date the GENIUS Act is set to take effect. In two actions concurrent to the final rule's issuance, the OCC also published guidance clarifying the application and waiver request processes for existing stablecoin issuers operating in the US ( Bulletin 2026-51 ), as well as finalizing a new set of weekly and quarterly reporting forms that PPSIs will be required to complete ( Bulletin 2026-52 ).

On August 25, 2026, the Superintendency of Panamanian Banks (SBP) approved Agreement No. 7-2026 , which modifies existing rules regarding the collection of certain commissions and surcharges by banking entities. The new agreement amends Articles 4 and 5 of Agreement No. 4-2011 to establish new prohibitions on fees for passive and active operations. According to the SBP , these updates are designed to guarantee a proper balance between banking consumers and financial institutions. Specific provisions of the agreement prohibit banks from charging commissions or surcharges for the following services, among others: The designation or change of beneficiaries in savings, checking or fixed-term accounts. The issuance of SWIFT message confirmations. The issuance and delivery of proof of a debtor's credit situation or a balance letter. In-person payments made directly at the banking entity. The issuance of bank reference letters. The issuance of a client's payment history, when requested once a year. The agreement takes effect on January 4, 2027 .

On October 20, 2026, the US Securities and Exchange Commission (SEC) announced that it has entered into a memorandum of understanding (MOU) with the French Autorité des Marchés Financiers (AMF). The agreement sets out a framework for consultation, cooperation and information-sharing in the supervision of investment advisers regulated by the SEC and investment service providers supervised by the AMF, where these firms operate in both the US and France. The MOU facilitates the SEC's registration and supervision of AMF-supervised asset management companies that wish to conduct business in the US as investment advisers. According to the SEC, this arrangement is intended to support cross-border market access while preserving investor protection and the integrity of the broader financial system in both jurisdictions. In light of the new arrangement, the SEC will process new and pending registration applications from AMF-supervised asset management companies.

On September 22, 2026, the Superintendency of Panamanian Banks (SBP) announced the approval of Agreement No. 8-2026 and Agreement No. 9-2026 , which together aim to strengthen the protection of banking customers, increase transparency in financial services and reinforce controls on transactions carried out through electronic channels. Agreement No. 8-2026 sets new guidelines for the verification of domestic electronic fund transfers. Banks must implement mechanisms to confirm that beneficiary details match the information held by banking entities before executing a transfer. Customers may also verify key transaction information in advance, including the account holder, the receiving bank and the transaction amount. The agreement further requires measures to flag potential inconsistencies that could lead to errors or fraud. It takes effect 9 months after its publication in the Official Gazette . Agreement No. 9-2026 amends Agreement No. 6-2026 by extending its entry into force to March 31, 2027 . This gives banks additional time to adapt their processes, systems and procedures to the new requirements. The agreement also introduces an illustrative amortization table model to serve as a reference for the credit-related information banks must provide to customers.

On October 19, 2026, the US Financial Crimes Enforcement Network (FinCEN) announced that it identified approximately US$270m in suspicious financial activity potentially linked to fraud against federal student aid programs. FinCEN has referred its findings to federal investigators to pursue potential fraud schemes and hold those responsible accountable. FinCEN's findings build on a July 2026 alert that warned financial institutions about student aid fraud and asked them to file suspicious activity reports (SARs) under the Bank Secrecy Act (BSA). The alert noted that school aid refunds are often sent by electronic bank transfer with payment descriptions containing the word "refund" and the school's name or initials. It also warned that fraudsters often move stolen aid through money mules, shell companies and fake accounts. According to FinCEN, financial institutions have filed nearly 100 SARs since the alert was issued, and FinCEN's review identified more than 20,000 potentially suspicious transactions since February 2026.

On October 19, 2026, the US Office of Foreign Assets Control (OFAC), in a coordinated effort alongside the US Department of State (DoS), added five Chinese entities to its Non-SDN Menu-Based Sanctions List (NS-MBS List) pursuant to the Protecting American Intellectual Property Act (PAIPA). The newly sanctioned entities are Beijing Qiji Chuangtan Phase I Venture Capital Center Limited Partnership, Beijing Qiji Chuangtan Phase II Venture Capital Center Limited Partnership, Beijing Qiji Chuangtan Zhiyuan Enterprise Management Center Limited Partnership, Qiji Chuangtan Beijing Investment Management Company Limited and Shanghai Zhisuan Technology Company Limited. Under Section 2 of PAIPA, all property and interests in property of these entities are blocked, and all transactions with them are prohibited, except for the importation of goods. Domestic financial institutions are prohibited from extending loans or credits to these entities exceeding US$10m in any 12-month period, and US persons are prohibited from investing in significant amounts of their equity or debt instruments. Foreign exchange and banking transactions subject to US jurisdiction that involve these entities are additionally prohibited. To supplement the new sanctions designations, OFAC issued two PAIPA-related general licenses: General License 1 , which authorizes transactions pursuant to OFAC's cyber-related sanctions regulations. General License 2 , which authorizes the wind-down of transactions involving the aforementioned newly sanctioned entities.

On October 16, 2026, the US Office of Foreign Assets Control (OFAC) issued Venezuela-related General License 60A , which authorizes transactions related to earthquake relief efforts in the country. The license permits specified transactions in support of humanitarian relief activities following earthquakes occurring in June 2026 in Venezuela. OFAC concurrently issued an amended frequently asked question (FAQ) document, FAQ 1263 , to provide guidance on the implementation and scope of the general license. The FAQ document clarifies permissible activities and transaction parameters for entities seeking to conduct earthquake relief operations in Venezuela under the newly amended general license and OFAC's broader Venezuela sanctions regime.

On October 15, 2026, the US Office of Foreign Assets Control (OFAC), as part of the US Department of the Treasury's broader "Operation Economic Outcast" campaign, sanctioned targets comprising Iran's shadow banking architecture and international financial networks. According to OFAC , the targets are used by the Iranian regime to evade sanctions and fund military and terrorist proxy activities, with the new sanctions designations intended to disrupt Iran's access to foreign currency and critical revenue streams. Among the targets are Iraq-based International Development Bank for Investment and Finance; Iran-based Jazireh International Bank Company and Chabahar International Bank Overseas Company; and Cuba-based Banco Internacional de Comercio SA. The action also targets multiple Iranian shadow banking operatives, including seven foreign exchange specialists employed by Farab Sorough Qeshm Company, an affiliate of Iran's Shahr Bank, and multiple currency exchange houses facilitating hundreds of millions of dollars in transactions. As a result of the new designations, all property and interests of these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC. Concurrent to issuing the new designations, OFAC also undertook the following actions: Issuing Iran-related General License FF , which authorizes the wind-down of transactions involving International Development Bank for Investment and Finance. Issuing Russia-related General License 128D , which authorizes certain transactions involving Lukoil retail service stations located outside of Russia. Issuing Russia-related General License 130B , which authorizes transactions involving certain Lukoil entities in Bulgaria.

On October 15, 2026, the US Financial Crimes Enforcement Network (FinCEN) issued an alert as part of the US Department of the Treasury's broader "Operation Economic Outcast" campaign. The alert directs financial institutions to report potential Iranian regime abuse of religious charity networks, including diversion of religious tithes known as khums. According to a news release , the alert aims to address the Iranian regime's documented practice of exploiting religious organizations in Iran and neighbouring countries to fund repression and support terrorism efforts. The alert outlines red flag indicators to assist financial institutions in detecting and preventing illicit activity, including as they surround khums payments. These indicators include: Charitable organizations that solicit donations without providing apparent charitable services, or openly supporting the Iranian regime. Charitable organizations receiving large donations from unknown sources over short periods followed by significant wire transfers to other organizations. Charitable organizations or their employees engaging in behaviour suggesting efforts to evade reporting or recordkeeping requirements. Customers receiving transfers from charitable organizations with no clear business relationship, subsequently withdrawing funds in cash or remitting them onward. FinCEN additionally emphasizes that legitimate charitable organizations should retain access to financial services through transparent channels, as well as reminding financial institutions to apply risk-based approaches to customer due diligence (CDD) when developing risk profiles for charitable organization customers, consistent with Bank Secrecy Act (BSA) requirements outlined in a separate fact sheet .

On October 15, 2026, the New York State Department of Financial Services (DFS) issued a consent order against Skandinaviska Enskilda Banken (SEB) and its New York branch. The consent order resolves the DFS's investigation into the bank's compliance failures with respect to New York banking law and Bank Secrecy Act (BSA) and anti-money laundering (AML) program requirements. The DFS investigation identified critical gaps in SEB's BSA/AML program, with key findings including inadequate customer due diligence (CDD), failure to implement strategies mitigating heightened money laundering risk associated with high-risk clients and deficient due diligence on high-risk correspondent banking partners, including foreign institutions. Additionally, the DFS found that SEB's transaction monitoring program in its Baltic subsidiaries in Estonia, Latvia and Lithuania was deficient in detecting and blocking suspicious activity. Specifically, SEB's transaction monitoring systems were backlogged, allowing transactions to evade timely review for money laundering and sanctions risks, thereby exposing SEB to processing illicit transactions. As part of the consent order, SEB is required to pay a civil monetary penalty of US$33m.

On October 14, 2026, the Financial Conduct Authority (FCA) issued finalised guidance ( FG26/11 ) replacing its previous general guidance on the Financial Policy Committee's (FPC) loan-to-income (LTI) flow limit recommendation. The Prudential Regulation Authority (PRA) simultaneously amended its Rulebook and issued a new supervisory statement on high LTI lending. The FPC recommended that the PRA and FCA amend implementation of the LTI flow limit to allow individual lenders to increase their share of high LTI lending above 15 percent, while ensuring the aggregate flow remains consistent with the 15 percent limit. This replaces guidance initially issued in October 2014 and revised in February 2017 and July 2025. The FCA and PRA jointly consulted on these amendments between April 1, 2026 and July 1, 2026, with the finalised policy set out in FCA PS26/20 (PRA PS19/26) . The finalised guidance applies to FCA-authorised mortgage lenders that are not PRA-authorised or subsidiaries of PRA-authorised firms. The PRA's amendments apply to all firms within scope of the Housing Part of the PRA's Rulebook, including UK subsidiaries of firms not already within the rules' scope. The PRA and FCA will calculate the aggregate flow of high LTI lending quarterly. The PRA will publish this figure on its website alongside the total volume of completed mortgages in scope and their share of all completed mortgages. The FCA will monitor aggregate flow and individual firm high LTI flows as part of supervisory engagement, and will monitor firm compliance with the expectations set out in its guidance and any temporary supplemental LTI guidance. This work forms part of the FCA's wider review of mortgage rules, which aims to protect borrowers and financial stability while allowing creditworthy households to access home ownership.

On October 13, 2026, the US Department of the Treasury announced enforcement actions imposing more than US$1.21bn in penalties against Bank of America (BoA) for violations of the Bank Secrecy Act (BSA) and anti-money laundering (AML) and sanctions laws. The enforcement actions consist of three separate orders from the US Financial Crimes Enforcement Network (FinCEN), US Office of Foreign Assets Control (OFAC) and US Office of the Comptroller of the Currency (OCC), all federal agencies housed within the Treasury. FinCEN issued a consent order assessing a US$1.2 billion monetary penalty for BoA's failure to mitigate and report priority national security risks, including Chinese money laundering networks and illicit finance along the southwest border of the US. As part of the FinCEN order, BoA admitted to willfull violations of the BSA, and that it failed to: Implement and maintain an AML program that met the minimum requirements of the BSA and FinCEN’s implementing regulations. Conduct due diligence for correspondent accounts for foreign financial institutions. File over US$5m in suspicious activity reports (SARs). The FinCEN order requires BoA to work with a third party to complete a lookback to identify and report to suspicious transactions that went undetected due compliance failures, as well as undergoing an independent review of the effectiveness of its suspicious activity monitoring, due diligence and data governance framework as it pertains to information used in its AML program. OFAC, in its enforcement release , announced a US$11.6m settlement agreement with BoA due to 475 violations across numerous sanctions programs, including those on Iran, Russia, narcotics and global terrorism. According to OFAC, the violations occurred when BoA channeled correspondent banking payments through blocked banks due to technical and human error; allowed sanctioned individuals to make payments and withdraw funds due to poor alert calibration; failed to promptly update watchlists following OFAC designations; and mishandled business accounts associated with blocked persons. Additionally, the OCC issued a consent order assessing a US$750m monetary penalty against BoA's for its BSA/AML compliance program, which was found to be ineffective. The program's ineffectiveness violated a December 2024 cease and desist order issued by the OCC, which required BoA to address deficiencies in its compliance program. According to the OCC, this resulted in poor transaction monitoring systems and large numbers of late SARs involving billions of dollars, with the OCC also finding that BoA staff lacked sufficient skills and training to effectively manage its BSA/AML program.

On October 13, 2026, the US Office of Foreign Assets Control (OFAC) sanctioned four individuals and 11 entities connected to Cartel del Noreste (CDN), a US-designated foreign terrorist organization (FTO) based in Mexico. The designations target individuals and entities involved in horse racing, construction, trucking and the oil and gas sector. According to a news release , CDN actively exploits these industries to launder illicit proceeds and finance cartel operations. OFAC found, for example, that CDN leaders purchased and raced horses in the US, laundering over US$22m through the operation, between 2008 and 2012. As a result of the new sanctions, all property and interests of these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC.

On October 8, 2026, the US Office of the Comptroller of the Currency (OCC) and US Federal Reserve Board (FRB) announced coordinated enforcement actions against American Express due to deficiencies identified in the firm's Bank Secrecy Act (BSA) and anti-money laundering (AML) compliance programs. According to an OCC news release and a FRB news release , the regulators jointly found that the firm failed to sufficiently detect and report certain suspicious activity related to money laundering. As part of the OCC's cease-and-desist order , American Express National Bank is directed to pay a $350m civil money penalty, which will be directed to the US Department of the Treasury. Concurrently, the FRB issued a cease-and-desist order against American Express Company and American Express Travel Related Services Company to ensure the firm addresses its compliance failures and operates in compliance with all applicable US laws and regulations.

On October 9, 2026, the US Office of Foreign Assets Control (OFAC) announced it has sanctioned the International Criminal Court (ICC). As a result of the new designation, all property and interests of the ICC are blocked, and US individuals and entities are generally prohibited from engaging in transactions with it, unless expressly authorized by OFAC. To supplement the designation, OFAC has also issued the following ICC-related general licenses: General License 13 , which authorizes transactions ordinarily incident and necessary to the maintenance or wind down of operations, contracts or other agreements involving the ICC. General License 14 , which authorizes certain transactions related to telecommunications and enterprise software involving the ICC. General License 15 , which authorizes transactions related to pension payments involving the ICC. General License 16 , which authorizes certain transactions related to certain ICC detainees.

On October 8, 2026, the US Office of Foreign Assets Control (OFAC) announced a new round of sanctions targeting Iranian shadow fleet vessels and front companies operating Iran's illicit maritime network as part of the US Department of the Treasury's broader "Operation Economic Outcast" campaign. The action designates vessels registered across jurisdictions including the Comoros, Panama, the Bahamas, Mongolia, Palau, Cameroon, Tanzania, Sierra Leone, Vanuatu, Hong Kong, San Marino and Gambia, along with 13 shipping companies and operators. According to Treasury Secretary Scott Bessent, the designations, which were made pursuant to Executive Order 13902 , "effectively neutralize the vast majority of Iran's remaining shadow fleet network" and represent efforts to cut off revenue that Iran generates from petroleum and petrochemical exports. As a result of the new designations, all US-based property and interests of the these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC. In a concurrent action, OFAC issued Iran-related General License EE , which authorizes the wind down of transactions involving Samudra Marine Services Private Limited, one of the newly sanctioned entities. Additionally, OFAC issued Russia-related General License 13S , which authorizes certain administrative transactions prohibited by Directive 4 under Executive Order 14024 .

On October 5, 2026, Brazil's Securities and Exchange Commission (CVM) launched a public consultation to update accounting standards applicable to publicly traded companies in alignment with international standards issued by the International Accounting Standards Board (IASB). Under the consultation, the CVM proposes making mandatory for publicly traded companies the Technical Pronouncements Review 30, issued by the Accounting Pronouncements Committee (CPC), which contains amendments to Technical Pronouncements CPC 18 (R3) and CPC 36 (R3) on investment in associates and jointly controlled entities and consolidated financial statements, respectively. According to the CVM , the consultation aims to reverse previously approved amendments and restore equivalence between CPC 18 and 36 with their corresponding international accounting standards. This equivalence seeks to ensure Brazilian accounting standards remain aligned with current international frameworks, supporting consistency in financial reporting for companies operating across multiple jurisdictions and enhancing comparability for investors and stakeholders. Interested parties may submit comments on the consultation until November 3, 2026 through three channels: The CPC via email at cpc@cpc.org.br . The CVM's Superintendency of Accounting Standards via email at conspublicasnc0226@cvm.gov.br . The Federal Accounting Council (CFC) via email at ap.nbc@cfc.org.br .

On October 6, 2026, the US Financial Industry Regulatory Authority (FINRA) fined Revere Securities US$800,000 for anti-money laundering (AML) and supervisory violations related to small-cap initial public offerings (IPOs) for foreign-based issuers. Specifically, FINRA found that Revere Securities acted as a lead underwriter or selling group member for foreign-based, small-cap IPOs that bore hallmarks of potential “ramp-and-dump” schemes, failed to detect and report potentially suspicious transactions related to those issuers and did not have a reasonable customer identification or due diligence program. As part of the settlement agreement , FINRA also requires Revere Securities to retain a third-party consultant to conduct a review of compliance with FINRA rules, obtain a report from the consultant with recommendations on how to remediate its supervisory procedures and systems and implement those recommendations.

On October 6, 2026, the Tennessee Department of Financial Institutions (DFI) announced the maximum effective rate of interest for home loans for the month of November 2026: 11.37 percent per annum.

On October 5, 2026, the US Office of Foreign Assets Control (OFAC) removed 125 individuals and entities from its sanctions lists as part of its ongoing sanctions modernization initiative. According to OFAC , the removals include deceased individuals, defunct entities and entries lacking sufficient information for effective compliance screening. The action also updated 22 list entries to enhance compliance screening. Concurrently, OFAC published an Iran-related alert , which notifies foreign financial institutions that continue to do business with Iran or its financial sector that they may be sanctioned under the US Department of the Treasury's broader “Operation Economic Outcast” campaign. Foreign financial institutions continuing to transact with sanctioned Iranian financial institutions could be targeted at any time without advance notification, with OFAC suggesting they take immediate action to terminate such activities and relationships. Additionally, OFAC published an amended Iran-related frequently asked question (FAQ) document, FAQ 156 , which outlines how US and foreign financial institutions will know that OFAC made a finding pursuant to the new alert and its Iran sanctions program.

On October 2, 2026, the US Federal Reserve Board announced an enforcement action taken against Ontario Bancorporation, a Wisconsin-based bank holding company that owns Bank of Ontario, a state-chartered, non-member bank. The enforcement action follows deficiencies identified during an off-site review conducted by the Federal Reserve Bank of Chicago, and addresses unsafe and unsound practices at Ontario Bancorporation. The enforcement action requires Ontario Bancorporation to act as a source of financial and managerial strength to Bank of Ontario under Section 38A of the Federal Deposit Insurance Act (FDIA) and the FRB's Regulation Y . Specific remedial action requirements of the enforcement agreement include: Submission of a capital plan within 60 days addressing the adequacy of capital, considering adversely classified credits, allowance for credit losses, asset growth and earnings projections. Submission of cash flow projections within 30 days for the remainder of 2026 and annually thereafter. An enhanced capital contingency plan addressing short-term and long-term capital needs. The agreement also imposes immediate restrictions on Ontario Bancorporation's ability to declare or pay dividends, engage in share repurchases or make capital distributions without prior written approval from the FRB and its Director of Supervision and Regulation. Ontario Bancorporation must additionally obtain prior written approval before incurring, increasing or guaranteeing any debt. Furthermore, Ontario Bancorporation must comply with notice provisions when appointing new directors or senior executive officers, and must submit quarterly progress reports to the FRB detailing compliance efforts.

On October 2, 2026, the US Office of Foreign Assets Control (OFAC) sanctioned three individuals and two entities for facilitating Hamas financing through sham charities and cryptocurrency channels. The designations were issued pursuant to Executive Order 13224 , as amended. According to a news release , the action exposed a multi-year financing scheme that moved more than US$2m to Hamas between 2020 and 2026. The newly sanctioned individuals are Saleem Abdallah Saleem al-Zaq, a Gaza-based battalion deputy in Hamas's military wing who oversaw financial networks using money services businesses (MSBs) and cryptocurrency wallets to transfer funds to the Hamas Al-Qassam Brigades, as well as France-based fundraisers Faouzi Barika and Amel Oualid, who operated sham humanitarian aid charities. The newly sanctioned entities are these sham charities, Association Baraka and Ensemble C Mieux, which were used as vehicles to funnel funds to Hamas operations. As a result of the sanctions designations, all US-based property and interests of the these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC.

On October 1, 2026, the US Office of Foreign Assets Control (OFAC) announced new sanctions targeting Iran's automotive, rail, manufacturing and steel sectors as part of the US Department of the Treasury's broader "Operation Economic Outcast" campaign. The Office of Foreign Assets Control (OFAC) issued the sectoral sanctions using a determination pursuant to Executive Order 13902 , as well as under the authority of Executive Order 13871 , authorizing it to sanction any individual or entity operating in certain Iranian industrial sectors. Specifically, OFAC designated multiple Iranian companies and their foreign suppliers. Iranian automotive entities designated include Iran Khodro Company, SAIPA Iranian Automobile Manufacturing Company and Niroo Motor Shiraz Industrial and Manufacturing Company. Foreign suppliers from Indonesia, the United Arab Emirates (UAE), Turkey and Hong Kong were also designated for facilitating auto parts shipments. In the rail sector, the Islamic Republic of Iran Railway Company, Raja Passenger Trains Company and Sherkat-E Rah Ahan-E Khamle-O-Naghle were designated. Additionally, Heavy Equipment Production Company and its China-based subsidiary were sanctioned, along with steel producers and traders, including entities in Germany and the UAE. As a result of the new designations, all US-based property and interests of these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC.

On October 1, 2026, the US Department of the Treasury announced a series of financial crime- and sanctions-oriented actions taken against the "A7 Network," a shadow banking network with ties to Russia and used by Iran to evade sanctions. The actions were taken by two sub-agencies of the Treasury: the US Financial Crimes Enforcement Network (FinCEN) and US Office of Foreign Assets Control (OFAC). According to the Treasury, the A7 Network processes more than 2,000 transactions daily, with transaction volumes exceeding US$91.5bn, representing roughly 13 percent of Russia's 2025 foreign trade transactions. Furthermore, it identified that A7 Network sub-agents processed more than US$17bn in transactions between January 2025 and June 2026. FinCEN issued a proposed rule prohibiting fund transmittals involving the A7 Network's sub-agents, as well as issuing an alert to assist financial institutions in detecting suspicious activity linked to the network. Interested parties my submit comments on the proposed rule up to 30 days after its publication in the Federal Register at this link . Concurrently, OFAC designated the A7 Network as a transnational criminal organization (TCO) due to its operation as a parallel financial system designed to disguise sanctioned or illicit payments as ordinary commercial activity. As a result of the new designation, all US-based property and interests of the A7 Network are blocked, and US individuals and entities are generally prohibited from engaging in transactions with it, unless expressly authorized by OFAC.

On October 1, 2026, the New York State Department of Financial Services (DFS) and Wyoming Division of Banking (DOB) signed a memorandum of understanding (MOU) to coordinate oversight of virtual currency and digital asset activities across both jurisdictions. According to a news release , the MOU is designed to enable the DFS and DOB to share expertise and supervisory insights to strengthen oversight while facilitating responsible innovation. In order to formalize coordination between the two states, the MOU establishes protocols for coordinating licensing and chartering processes for entities already licensed in one jurisdiction or applying simultaneously in both. Under the MOU, the DFS and the DOB will share analyses, subject matter reviews and historical examination data to streamline applications. The regulators will also coordinate examination schedules and pursue joint examinations of entities operating in both states. Additionally, the MOU creates mechanisms for sharing supervisory reports, market trend data and notifications regarding potential enforcement actions.

On September 30, 2026, the Financial Conduct Authority (FCA) published Policy Statement PS26/19, finalising rules to align listed issuers' sustainability and climate disclosures with the UK Sustainability Reporting Standards (UK SRS), the UK-endorsed version of the International Sustainability Standards Board (ISSB) Standards. The rules replace existing Task Force on Climate-related Financial Disclosures (TCFD)-aligned requirements that have been in place since 2020 for premium listed companies and extended to other listed issuers in 2021. The FCA adopted a comply or explain approach across all UK SRS categories, rather than mandating full compliance. This reflects feedback that mandatory requirements could impose disproportionate costs on smaller issuers and overseas-based companies, potentially affecting the attractiveness of UK listings. The rules apply to five listing categories: equity shares (commercial companies) equity shares (transition) non-equity shares and non-voting equity shares equity shares (international commercial companies secondary listing) certificates representing certain securities (depositary receipts). To support implementation, the FCA provides transitional reliefs: a one-year relief for Scope 3 emissions disclosures and a two-year relief for UK SRS S1 (non-climate) disclosures.

On September 30, 2026, the US Office of Foreign Assets Control (OFAC) sanctioned 10 targets involved in a fraud scheme that has become a key revenue source for Tren de Aragua (TdA), a designated foreign terrorist organization (FTO) originating in Venezuela. According to OFAC , TdA is responsible for violent and exploitative criminal activity across the Americas region, including drug trafficking, human trafficking, extortion and murder-for-hire plots. TdA was also found to have been operating a "jackpotting" scheme targeting US-based automated teller machines (ATMs), where it deployed malware to force ATMs to dispense cash without debiting accounts. Specifically, OFAC's action, taken pursuant to Executive Order 13224 , sanctions eight individuals and two entities for their involvement in TdA's "jackpotting" scheme. As a result of the new designations, all US-based property and interests of these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC.

On September 30, 2026, the US Federal Reserve Board (FRB) announced two final rules implementing changes to its supervisory stress test framework designed to enhance transparency, public accountability and reduce volatility in stress test-related capital requirements for large banks. The two final rules were adopted in a manner largely consistent with corresponding proposals issued in October 2025. The first final rule , effective 30 days after publication in the Federal Register , requires the FRB to invite public input annually on stress test scenarios and material model changes. It also updates the framework guiding hypothetical scenario design, as well as adopting models for the 2027 edition of the stress test. Additionally, this rule adjusts the stress test calendar and modifies the global market shock component (i.e., a set of shocks applied to banks with large trading books). Under the rule's new approach, banks will be tested against two global market shock components annually, with the FRB using the shock producing the largest losses for each firm to calculate ultimate stress test results. The second final rule , effective 60 days after publication in the Federal Register , requires the FRB to average stress capital buffer requirement results from the two most recent annual supervisory stress tests for firms subject to stress testing in both years. This rule stipulates that the FRB will begin averaging requirements in 2028 to ensure only models incorporating public input are used in these calculations. Concurrently, the FRB is requesting comment on a proposed rule to revise its non-interest income model to better capture business model diversity across banks. If adopted, the proposed rule would replace the current model projecting each bank's fee income under stress. According to the FRB, these changes are expected to reduce year-over-year volatility in capital requirements by approximately 50 percent, and are not expected to materially affect aggregate capital requirements. Interested parties may submit comments on the proposed rule up to 60 days after publication in the Federal Register at this link .

On September 30, 2026, the US Office of Foreign Assets Control (OFAC) published its new Cuba Sanctions Regulations (31 Code of Federal Regulations (CFR) Part 516) to implement Executive Order 14404 . The regulations establish comprehensive prohibitions on transactions involving designated individuals and entities related to Cuba. Key provisions of the regulations include blocking of property and interests in property of sanctioned individuals and entities; prohibiting transactions by US individuals and entities involving blocked property; and restricting foreign financial institutions conducting transactions for sanctioned parties. The regulations define sanctionable conduct to include individuals and entities operating in Cuba's energy, defense, metals and mining, financial services and security sectors, as well as those responsible for human rights abuses or corruption. The regulations also impose travel restrictions on designated individuals and authorize OFAC to impose sanctions on foreign financial institutions, including prohibitions on correspondent accounts and payable-through accounts in the US. The regulations are currently available for public inspection and will take effect upon publication in the Federal Register on September 30, 2026 . Additionally, OFAC amended its Cuban Assets Control Regulations (31 CFR Part 515) to implement portions of President Trump's foreign policy toward Cuba, including including as directed by National Security Presidential Memorandum 5 (NSPM-5). OFAC also published five new Cuba-related frequently asked question (FAQ) documents, as well as amending 29 existing FAQ documents, to supplement its new Cuba sanctions program. Concurrently, OFAC published an alert which highlights increased sanctions risks for transactions involving Cuba.

On September 29, 2026, the US Office of Foreign Assets Control (OFAC), pursuant to Executive Order 13382 , designated 10 individuals and entities linked to Iranian military procurement networks, targeting international intermediaries, technology front companies and representatives of Iran’s Ministry of Defense and Armed Forces Logistics (MODAFL). According to a news release , the designations focus on disrupting Iranian procurement of weapons and dual-use components under the US Department of the Treasury's broader "Operation Economic Outcast" campaign, degrading Iran's ability to develop its ballistic missile and unmanned aerial vehicle (UAV) programs. The designations include defense contractors and procurement facilitators operating across multiple jurisdictions, including China, Hong Kong and Pakistan, used to secure critical electronics and distribute weapons on behalf of the Iranian military. As a result of the new sanctions designations, all US-based property and interests of these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC.

On September 29, 2026, the US Office of Foreign Assets Control (OFAC) designated 21 individuals and 25 entities linked to the Sinaloa Cartel, targeting cartel leadership, money laundering vehicles and Mexican government officials. According to a news release , the designations focus on disrupting the cartel's control of drug trafficking routes in Baja California, particularly around Tijuana and Mexicali, areas strategically positioned near the US-Mexico border. They were made pursuant to Executive Order 14059 , which targets international drug proliferation, and Executive Order 13224 , targeting terrorists and their supporters. The designations include financial facilitators operating money exchanges and front companies used to launder drug proceeds through bulk cash collections and cryptocurrency transactions. As a result of the new designations, all US-based property and interests of these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC.

On September 28, 2026, the Office of the Commissioner of Financial Institutions (OCFI) issued a circular establishing the Financial Reporting System (FIRE System), a centralized electronic platform for financial institutions to submit required reports and regulatory information. The FIRE System modernizes the OCFI's processes for collecting, validating, analyzing, and managing financial data from all entities subject to its jurisdiction and supervision. The FIRE System will centralize financial reporting across: Depository institutions such as banks, cooperative banks, trust companies, international banking entities. Non-depository institutions such as mortgage companies, finance companies, pawnshops, casinos, money transmitters, leasing companies. Securities institutions such as broker-dealers, investment advisers, private equity funds, investment companies. Other regulated entities including the Puerto Rico Housing Finance Authority and the Association of Employees of the Commonwealth of Puerto Rico. Financial institutions will access the FIRE System at no cost to identify applicable reports, filing frequencies, deadlines, and certification requirements specific to their license type, operations nature, and regulatory classification. Implementation occurs in phased stages. Banks, the Economic Development Bank, the Cooperative Bank, the Puerto Rico Housing Finance Authority, and the Association of Employees of the Commonwealth of Puerto Rico must submit reports for the period ending September 30, 2026, beginning October 1, 2026. Subsequent stages will incorporate other depository, non-depository, and securities institutions according to a schedule the OCFI will communicate. Financial institutions must register, complete assigned reports with accurate information, attach required documentation, and submit within established deadlines. Failure to comply may result in administrative fines and sanctions and applicable special legislation. The circular is effective upon publication.

On September 28, 2026, the Central Bank of Brazil (BCB) published Resolution BCB No. 590, which prohibits financial institutions, payment institutions, payment arrangement founders, and other payment arrangement participants from processing, settling, or facilitating transactions intended for fixed-quota lottery betting. The resolution implements Article 14 of Provisional Measure No. 1,394 , published on September 25, 2026. The prohibition applies from the date of publication of the provisional measure. Financial institutions and payment arrangement participants must immediately prevent the processing, settlement, and facilitation of fixed-quota lottery betting transactions. However, the prohibition does not apply to transactions necessary for closing operations and returning funds to bettors. Compliance with this obligation does not require amendments to payment arrangement regulations, though founders of payment arrangements must alter their regulations to comply with the provisional measure's requirements. Payment arrangement founders may amend their regulations immediately without prior authorization from the BCB or prior consultation with arrangement participants. However, they must communicate any regulatory amendments to the BCB and arrangement participants immediately after implementation. The resolution entered into force on the date of its publication, September 28, 2026. The regulation applies to all entities involved in processing payments related to fixed-quota lottery betting within Brazil's financial system.

On September 28, 2026, the Mississippi Department of Banking and Consumer Finance (DBCF) issued a memorandum introducing the AI Supervisory Framework , a new supervisory resource developed by the Conference of State Bank Supervisors (CSBS) to help examiners and regulated money services businesses (MSBs) approach artificial intelligence (AI) use in a consistent, risk-based manner. The framework addresses the expanding use of AI across financial services, including in operations, customer communications, decision support, vendor-provided platforms, compliance functions, fraud detection, account servicing and underwriting support. The framework was developed as a practical, examiner-facing tool that draws on existing public materials, including supervisory guidance and cross-sector risk management frameworks, and organizes them around questions examiners must answer when reviewing a MSB's use of AI. While designed primarily for examiners, the memorandum notes that any regulated MSB may use the framework to develop or refine risk management and governance practices for AI exploration, implementation or ongoing use. The framework includes: An examiner guide with scoping questions, document request lists and examination procedures. An examiner work program. Non-bank AI supplements addressing third-party vendor risks, model risk and consumer protection. An optional AI use case risk-tiering worksheet for risk-based evaluation of individual AI use cases. In the memorandum, the DBCF encourages MSBs to review current AI governance practices, policies and inventories in light of the framework's scoping areas, and to prepare for discussions regarding AI use during scheduled examinations beginning in 2027. The framework, which will be reviewed and updated periodically as AI technology, public guidance and supervisory experience evolve, does not create new reporting obligations or supervisory requirements for MSBs.

On September 25, 2026, the U.S. Securities and Exchange Commission (SEC) published frequently asked questions (FAQs) addressing the application of federal securities laws to certain types of crypto-assets and transactions involving crypto-assets. The FAQs represent the views of the SEC's Division of Corporation Finance staff and do not constitute a rule, regulation, or official statement of the Commission. The SEC clarified that the FAQs have no legal force or effect, do not alter or amend applicable law, and do not create new or additional obligations. The FAQs address two primary areas: Clarification regarding classification of crypto-assets under Section III of the Commission's March 17, 2026 Interpretive Release, including guidance on staking receipt tokens, redeemable wrapped tokens, and receipts generally. The SEC explained that staking receipt tokens serving as receipts for digital commodities function as digital tools, though they may also be classified as digital commodities if issued by protocol-based liquid staking providers. The FAQs address crypto-assets subject to investment contracts under Section IV of the Interpretive Release, providing guidance on when promotional communications constitute representations or promises of essential managerial efforts, the treatment of buyback programs, and the circumstances under which functional crypto systems cease to be subject to investment contract classification. The SEC provided clarification that once a crypto system achieves functionality, services to secure, maintain, improve, or enhance the system would not constitute essential managerial efforts. Additionally, the Commission indicated that trading platforms offering secondary markets for crypto-assets would only be considered promoters if they meet the definition under Securities Act Rule 405 . These FAQs provide market participants with staff-level interpretive guidance to facilitate compliance with applicable securities laws in the evolving crypto-asset market.

On September 23, 2026, Global Affairs Canada announced that Canada is imposing additional sanctions against five individuals and five entities under the Special Economic Measures (Iran) Regulations . The sanctions target senior Iranian security and government officials, as well as state-backed entities, for their role in the Iranian regime's repression of its population and involvement in digital repression and human rights violations. The sanctioned individuals and entities have contributed to Iran's efforts to suppress dissent and restrict freedoms, including through digital surveillance, censorship, unlawful violence, arbitrary detention, and intimidation. Canada has sanctioned a total of 478 Iranian individuals and entities across Iran’s security, intelligence and economic system under the Special Economic Measures (Iran) Regulations and the Justice for Victims of Corrupt Foreign Officials Act , with the majority of such measures imposed since 2022. These measures impose a dealings prohibition, which effectively freezing any assets that sanctioned persons may hold in Canada and prohibits entities in Canada and Canadians abroad from making property available to sanctioned individuals and entities. Listed individuals are also classified as inadmissible to Canada under the Immigration and Refugee Protection Act .

On September 24, 2026, the Central Bank of Brazil (BCB) and the European Central Bank (ECB) initiated an evaluation phase to assess the feasibility of interconnecting Pix, Brazil's instant payment system, with TARGET Instant Payment Settlement (TIPS), the Eurosystem's instant payment settlement service. The institutions will evaluate technical, operational, legal, and commercial aspects related to interconnecting the two public payment infrastructures. TIPS operates as a pan-European instant settlement infrastructure in central bank money, currently supporting the euro, Swedish krona, and Danish krone, with planned expansion to other currencies within the European Economic Area. The BCB and ECB's assessment of Pix interconnection complements the Eurosystem's ongoing efforts to connect TIPS to other instant payment infrastructures, including Nexus and payment systems in India and Switzerland. Given the significant economic and financial flows between Brazil and the eurozone, interconnecting Pix and TIPS could facilitate faster, more efficient, and lower-cost cross-border payments between the two jurisdictions. The initiative aligns with Pix's evolutionary agenda and the BCB's broader efforts to interconnect Brazil's instant payment system with similar multilateral infrastructures and systems in other jurisdictions.

On September 24, 2026, Brazil's Central Bank (BCB) published Resolution CMN No. 5.343, governing credit rights investment funds and credit rights fund quota investment funds. The resolution introduces restrictions on credit rights funds' ability to invest, directly or indirectly, in rights or expectations arising from judicial actions or arbitration proceedings. Funds may only invest in such assets once the underlying credit achieves liquidity, certainty, and enforceability on a definitive basis. For judicial proceedings, this requires: Final judgment recognizing the right in the knowledge phase. Final judgment in the liquidation phase determining the amount owed, if necessary. Expiration of the legal period for challenging sentence execution or arbitration objections without presentation, or final judgment dismissing such challenges if presented. For arbitration proceedings, requirements include: Issuance of an arbitral award recognizing the right and fixing the amount owed. Expiration of the period for filing nullity actions  without such action being filed, or final judgment dismissing or extinguishing any filed action. The resolution also defines indirect investment as acquisition of securities, financial instruments, fund quotas, or derivative instruments whose underlying assets or cash flows are linked to such litigation-derived rights. Funds holding prohibited litigation-linked assets must: Adopt consistent, independently verifiable valuation methodologies. Conduct revaluations following material procedural developments. Submit to independent audit verification. Disclose standardized, comparable information monthly in structured electronic format, including fund identification, judicial or arbitration proceeding details, cedent and cessionary identification, credit value and fraction held, and portfolio composition by debtor entity. The resolution enters into force October 13, 2026, regarding investment restrictions, and January 4, 2027, regarding disclosure and valuation requirements.

On September 24, 2026, the US Federal Reserve Board (FRB) requested public comment on two proposals establishing a regulatory framework for FRB-supervised permitted payment stablecoin issuers (PPSIs) under the Guiding and Establishing National Innovation for US Stablecoins (GENIUS) Act . The first proposal would require FRB-supervised payment stablecoin issuers to fully back their stablecoins with permissible reserve assets, including short-term Treasury bills and other high-quality, liquid assets. This proposal would also establish standardized capital requirements addressing credit and operational risks associated with payment stablecoin activities, alongside risk management standards. It would additionally create rules for FRB-supervised firms that safeguard assets backing payment stablecoins, as well as clarifying the permissibility of stablecoin and related activities for FRB-supervised banks. The second proposal would create a tailored application process for FRB-supervised banks seeking to issue payment stablecoins. Applicants would be mandated to submit a business plan, financial statements and other specified documentation. This proposal would also establish a process governing appeals, hearings and final determinations for applications. According to a FRB news release, the two proposals aim to provide a comprehensive regulatory framework ensuring that payment stablecoin activities conducted by PPSIs and other FRB-supervised institutions operate safely and soundly, with appropriate safeguards in place for reserve assets and capital protections. Interested parties may submit comments up to 60 days after the proposals' publications in the Federal Register at this link .

On September 24, 2026, Mexico's Financial Intelligence Unit  published a resolution modifying the official format for registration of vulnerable activities under anti-money laundering legislation. The resolution updates requirements established under the Federal Law for the Prevention and Identification of Operations with Illicit Proceeds . The modification expands the registration format to explicitly identify new categories of vulnerable activity participants, including: Public and private alternative dispute resolution facilitators. Customs agencies. Natural and legal persons promoting merchandise clearance without customs agent intervention. Entities operating through trusts or other legal structures. The updated format requires comprehensive identification data for all participants, including trustees, trust beneficiaries, and trust settlors where applicable. It also introduces a new electronic format for designating compliance representatives and establishes mandatory fields for contact information, vulnerable activity details, business addresses, and compliance officer appointments. The resolution establishes a phased implementation timeline. The primary provisions take effect February 1, 2027. Alternative dispute resolution facilitators have an extended deadline of June 1, 2027. Entities that registered under the previous format before February 1, 2027 must deregister and immediately re-register using the updated format to clearly identify their operational capacity. The Financial Intelligence Unit published the updated electronic formats as Annexes A and B, specifying mandatory and optional data fields for vulnerable activity registration and compliance representative designation.

On September 23, 2026, the US Financial Industry Regulatory Authority (FINRA) announced the completion of a major organizational consolidation, integrating its member supervision, market oversight, and enforcement functions into a unified Regulatory Operations department. The consolidation aims to optimize FINRA's operations, improve organizational efficiency, and strengthen investor and market protections through more coordinated and effective regulatory oversight. The new Regulatory Operations structure comprises five core oversight functions: Risk and Intelligence, which identifies and proactively addresses potential risks to member firms and investors. Examinations, which conducts risk-based inspections to assess compliance with FINRA rules and federal securities laws. Surveillance, which processes billions of daily market events and runs proprietary threat scenarios to detect violations. Investigations, which conducts targeted inquiries into potential violations. Enforcement, which evaluates violations and brings disciplinary actions where appropriate. FINRA has also integrated critical support services across these functions to eliminate duplication and improve efficiency. The consolidation is designed to reduce complexity, empower leaner teams, and enable closer integration of business processes and technology. FINRA is also evolving its business processes and technology platforms, including harnessing artificial intelligence capabilities, as a multi-year effort to fully realize the transformation's benefits.

On September 16, 2026, the Superintendency of Banks (SB) established a formal process enabling supervised financial intermediaries, foreign exchange intermediaries, and trust companies to request evaluation for deactivation of regulatory information reporting obligations that do not apply to their operational nature. The measure forms part of the Strategy for Simplification, Modernization and Self-Management of Regulatory Compliance (SIMA), an SB initiative designed to strengthen regulatory compliance efficiency, reduce unnecessary operational burdens, and concentrate supervised entities' efforts on obligations that genuinely apply to them. The process is outlined in Circular SB: CSB-REG-2026000016 and employs a formal, risk-based evaluation framework to determine the viability of deactivation and subsequent reactivation requests for information requirements. Under the previous framework, entities must submit all reports mandated by applicable regulations, even when generating no information for a given period, through empty file reports or blank document uploads. The SB acknowledged this mechanism strengthened compliance controls but created operational burden for entities whose business models render certain obligations permanently inapplicable. The new disposition allows entities to identify requirements unrelated to their operations and formally request evaluation for possible deactivation. The SB will analyse each case and determine whether to exclude the corresponding obligation while preserving information quality, timeliness, and traceability required for supervisory functions. All active obligations must continue being fulfilled according to established timelines and conditions, regardless of operational activity. The SB plans additional SIMA initiatives, including developing a case self-management system for entities to regularize identified non-compliance, optimizing the Information Requirements Manual for efficient consultation and real-time updates, and publishing a validation rules catalogue promoting proactive regulatory information quality review.

On September 24, 2026, the US Office of Foreign Assets Control (OFAC) published several regulatory changes consolidating enforcement procedures and penalties information across its sanctions regulations. Specifically, OFAC created a new part within Title 31, Code of Federal Regulations (CFR) Chapter V (Sanctions Penalties Regulations), which consolidates previously dispersed information regarding enforcement procedures, civil penalties and the rights of US individuals and entities under investigation for regulatory violations. This consolidation results in the deletion of more than 100 sub-parts from existing regulations within 31 CFR Chapter V, with parts updated to cross-reference the new consolidated regulations instead. Additionally, OFAC amended its Terrorism List Governments Sanctions Regulations to implement changes resulting from the rescission of Syria's designation as a state sponsor of terrorism. Under the amendments, OFAC removed and reserved a Syria-specific general license, as its transaction authorizations are no longer necessary following the rescission. OFAC also released its Quarterly Report of Licensing Activities pursuant to Section 906(b) of the Trade Sanctions Reform and Export Enhancement Act of 2000 (TSRA), covering activities undertaken under Section 906(a)(1) of the TSRA from April through June 2026. Under TSRA procedures, OFAC processes license applications authorizing the export of agricultural commodities, medicine and medical devices to Iran under the specific licensing regime established in the TSRA.

On September 23, 2026, the Central Bank of Brazil (BCB) published Resolution BCB No. 589, which amends Resolution BCB No. 520 . The amendment modifies regulations governing virtual asset service provider companies and virtual asset service provision by other institutions authorized to operate by the BCB. The resolution introduces enhanced reporting requirements for eligible institutions providing virtual asset services. Institutions must now submit: Detailed information on accounting balances maintained for clients and users. Virtual asset custody services (including total assets custodied domestically and internationally, broken down by quantity and financial value). Verifiable proof of virtual asset reserves held for clients and users (itemized by asset type). Verifiable statements of total client or user virtual assets designated for staking operations where applicable. These information submissions must be made either from the commencement of virtual asset market services or immediately, depending on the institution category. The resolution also establishes a prohibition effective November 6, 2026, preventing financial institutions, payment institutions, and other BCB-authorized entities from conducting or facilitating virtual asset market operations with counterparties that provide virtual asset services but lack authorization to operate in Brazil, except where expressly permitted under the resolution. The BCB will establish specific procedures and conditions for information submission through further regulation. The resolution enters into force in two phases: amendments to Article 91 take effect October 1, 2026, while remaining provisions take effect January 1, 2027.

On September 23, 2026, the US Office of Foreign Assets Control (OFAC) removed multiple individuals and entities linked to its Democratic Republic of the Congo (DRC) sanctions program from the Specially Designated Nationals (SDN) list. Specifically, OFAC delisted Francois Olenga, identified as Head of the Military House of the President, along with four alternative name variations under which he was listed. OFAC additionally removed three entities associated with Olenga: Safari Club, Centre de Loisir Safari Club and Safari Beach. The removal of these designations means that US individuals and entities are no longer prohibited from engaging in transactions with the now-delisted individuals and entities.

On September 22, 2026, the U.S. Financial Industry Regulatory Authority (FINRA) announced that it had ordered American Portfolios Financial Services, Inc. to pay $1,232,939 in restitution plus interest to 295 customers and fined the firm $400,000 for failing to reasonably supervise recommendations that customers sell unit investment trusts (UITs) before their maturity dates, in violation of FINRA Rule 2111 (Suitability) and Regulation Best Interest's Care Obligation . From January 2018 to October 2024, when it became part of Osaic Wealth, Inc., American Portfolios failed to implement written policies and procedures reasonably designed to identify representatives who repeatedly recommended early UIT sales, a practice that results in customers incurring additional sales charges that would not arise if UITs were held to maturity. American Portfolios consented to FINRA's findings without admitting or denying the charges.

On September 21, 2026, the Canadian Investment Regulatory Organization (CIRO) released its 2026 Annual Report covering activities from April 1, 2025 to March 31, 2026. According to CIRO's press release , the report documents CIRO's progress in delivering on its primary objective of investor protection and market integrity across Canada's investment dealer and mutual fund dealer sectors. CIRO oversaw market surveillance of more than $7trn in trade value and maintained oversight of more than 106,000 registrants across 250 Dealer Member firms during the reporting period. Enforcement activity resulted in sanctions and fines totaling $7.6m imposed on individuals and $8.6m on firms. The organization successfully delivered on all 2026 Annual Priorities and made significant progress on objectives outlined in its Strategic Plan , such as the publication of amendments to the client reporting rules and guidance from the Client Focused Reforms (CFR) Phase 2 sweep . Key regulatory developments included evolving guidance to support non-tailored advice and do-it-yourself investors, distributing more than $1.5m in grants to Canadian non-profit organizations focused on investor education and protection, and publishing new research on how do-it-yourself investors use social media for investment purposes. CIRO also launched InnovateSafe, a regulatory sandbox enabling testing of new business ideas and practices without requiring regulatory exemptions. Additionally, CIRO's Investor Advisory Panel (IAP) published its IAP Annual Report in its third year, providing input on policy consultations and issues affecting investors. The panel also worked in collaboration with CIRO's Office of the Investor to release its first research report on Women and Investing, examining the needs, goals and experiences of Canadian women at various investing stages. CIRO has extended its current Strategic Plan by one year to allow the incoming chief executive to help shape the organization's future strategic direction.

On September 21, 2026, the Governor of New York State announced future implementation steps for the Responsible AI Safety and Education (RAISE) Act , which mandates that a targeted regulatory framework be created governing the development and deployment of advanced frontier AI models. According to the announcement, beginning in November 2026, large frontier AI developers will be required to register with the state and prepare for compliance with strict transparency, safety and incident reporting requirements, as provided under the RAISE Act. Effective January 1, 2027, developers will be required to comply with these standards and provide regular reporting to the new Office of Digital Innovation, Governance, Integrity and Trust (DIGIT), housed within the New York State Department of Financial Services (DFS). The RAISE Act requires developers to establish and publish safety and transparency frameworks; report critical safety incidents to DIGIT within 72 hours; file quarterly assessments of catastrophic risks; and register with DIGIT, filing disclosure statements at least biennially and paying applicable assessments. The DIGIT Office will produce annual public reports summarizing incident reports received, observations about frontier model safety and recommended legislative changes. The public may also file suspected critical safety incident reports with DIGIT, which may transmit them to other government authorities as appropriate. In the announcement, Governor Kathy Hochul also indicated that she will explore further measures to strengthen New York State's AI safety regulations in the coming months, building on the RAISE Act's existing framework.