Published

The State Bank of Vietnam (SBV) is seeking feedback on proposed amendments to its decree regulating cashless payments. The proposed amendments contain: New definitions for e-wallet services, payment systems, and international payment systems. Regulations prescribing the operational conditions for foreign organizations providing payment and intermediary payment services to non-residents and foreign residents in Vietnam. Specific rules for managing payment accounts that have not generated any transactions for three years or more. New IT security, operational, and personnel requirements for public postal service enterprises providing payment services without customer payment accounts. Provisions outlining the minimum charter capital, personnel qualifications, and IT security standards for intermediary payment service providers. Administrative amendments imposing comprehensive procedures and documentation requirements for granting, amending, and revoking licenses for intermediary payment services. The SBV has not provided a closing date for the consultation or a preferred method for feedback.

On June 4, 2026, the Bank of Lithuania announced it had issued a €90,000 fine and warning to UAB Nuvei for violations found after a targeted inspection. Following a targeted scheduled inspection assessing Nuvei’s compliance with requirements for the prevention of money laundering and terrorist financing, and the protection of customer funds, the Bank found violations related to the management of conflicts of interest, enhanced customer identification, monitoring of customer business relationships and operations, and the implementation of internal control procedures for the protection of customer funds. Nuvei stated to the Bank of Lithuania that they had eliminated the identified violations and committed to a future audit of their actions and so applied for the possibility of concluding an administrative agreement. The Bank of Lithuania made the decision to conclude an administrative agreement and issued the following enforcement measures: A warning was issued for the violation of improper management of conflicts of interest. A fine of €90,000 for violations related to enhanced customer identification, monitoring of customer business relationships and operations A public announcement for the violation of internal control procedures in the area of ​​customer funds protection.

On June 2, 2026, the Basel Committee on Banking Supervision (BCBS) of the Bank for International Settlements (BIS) published a report analysing information and communication technology (ICT) risk management practices across jurisdictions. The report addresses non-malicious ICT incidents and supports banks in developing robust ICT risk management frameworks as a critical aspect of operational risk management. The BCBS conducted this analysis to strengthen banks' operational resilience to ICT incidents in an increasingly digitalised world. The report examines a range of ICT risk management practices currently implemented across different jurisdictions, providing banks with guidance on establishing comprehensive frameworks. By focusing on operational resilience through effective ICT risk management, the guidance contributes to the broader regulatory objective of ensuring financial stability and protecting the banking system from disruptions caused by technology-related failures and incidents. The practices documented may serve as reference points for banks and supervisory authorities to adapt and develop ICT risk management practices that are most appropriate for their specific circumstances.

On June 2, 2026, the Financial Conduct Authority (FCA) published anti-money laundering (AML) guidance addressing questions from firms preparing for the transition to the new cryptoasset regulatory regime under the Financial Services and Markets Act 2000 (Cryptoassets) Regulations 2026 (FSMA). The guidance clarifies the interaction between the current Money Laundering, Terrorist Financing and Transfer of Funds (Information on the Payer) Regulations 2017 (MLRs) and the forthcoming FSMA regime, which commences in October 2027. The FCA will begin accepting applications for FSMA authorisation from September 30, 2026, with the application window remaining open until February 28, 2027. Firms currently registered under the MLRs should note that no automatic conversion will occur; they must secure separate authorisation under FSMA. The FCA encourages new firms to pursue FSMA authorisation rather than MLR registration, though firms with specific business justifications may still apply for MLR registration after September 30, 2026 through the Pre-application Support Service (PASS).

On June 4, 2026, the Dutch Authority for the Financial Markets (AFM) published guidance addressing how financial enterprises should conduct client due diligence when dealing with politically exposed persons (PEPs). The AFM conducted a thematic investigation into the handling of PEPs under the Money Laundering and Terrorist Financing (Prevention) Act (Wwft) which revealed that many financial institutions fail to apply tailored approaches to PEP assessments, despite each PEP presenting distinct risk profiles. The AFM identified several key concerns, such as: Institutions often applying generic measures without evaluating individual PEP-specific risks, and some using nationality as a standalone criterion in risk assessments, which risks unjustified discrimination. Inconsistent definitions and applications of what constitutes a PEP within institutions. The implementation often deviates from PEP policies that are in place, and documentation of client due diligence steps are frequently inadequate. To address these issues, the AFM presents good practices that institutions should adopt, including: Establishing a risk-based approach to the risk classification and assessment of a PEP. Having clearly established definitions. Establishing clear responsibilities among staff and outsourced tools. Investing in training and awareness of employees involved in conducting customer due diligence. Ensuring complete and traceable documentation used for customer due diligence. The guidance stems from findings in the Financial Action Task Force's (FATF) 2022 evaluation .

On June 3, 2026, the United Kingdom Treasury made the Financial Services and Markets Act 2023 (Commencement No. 14) Regulations 2026, bringing specified provisions of the Financial Services and Markets Act 2023 (FSMA 2023) into force. The regulations revoke assimilated European Union (EU) legislation relating to short selling and credit default swaps. Specifically, the Regulations revoke Regulation (EU) No 236/2012 on short selling and certain aspects of credit default swaps, the F inancial Services and Markets Act 2000 (Short Selling) Regulations 2012 , and associated EU delegated and implementing regulations. The Regulations Enter into force on July 13, 2026.

On June 3, 2026, the Financial Action Task Force (FATF) published Indonesia's Third Enhanced Follow-Up Report assessing the country's progress in strengthening anti-money laundering and counter-terrorism financing (AML/CTF) measures since its 2023 mutual evaluation report (MER). Indonesia has made progress in addressing the technical compliance deficiencies identified in its MER and has been re-rated on one recommendation. Recommendation 6 on targeted financial sanctions related to terrorism and terrorist financing has been re-rated from partially compliant to compliant. Indonesia has seven recommendations rated "Compliant" and 30 rated "Largely Compliant". Three Recommendations remain "Partially Compliant".

On June 3, 2025, HM Treasury released an updated version of the Orange Book, the government's guidance on managing risk in the public sector. The publication builds on the original Orange Book released in 2020 and introduces a new section addressing the risk control framework alongside existing principles-based guidance on risk management. The Orange Book applies to all government departments and arm's length public bodies, including executive agencies, non-departmental public bodies, and non-ministerial departments. The updated guidance is structured in two parts. Part I sets out five main principles for effective risk management. Part II introduces a Risk Control Framework (RCF) consisting of four pillars. The guidance adopts a "comply or explain" approach, requiring organisations to either demonstrate adherence to main principles or clearly explain departures in their governance statements.

On June 2, 2026, the Reserve Bank of India (RBI) and the National Bank of Cambodia (NBC) have announced the launch of a payments linkage between India's Unified Payments Interface (UPI) and Cambodia's national QR code (KHQR). Under the first phase of the initiative, which represents collaboration between NPCI International Payments Limited (NIPL) and Acleda Bank Plc., operating under the aegis of the RBI and the NBC, Indian travellers visiting Cambodia will now be able to make QR code-based payments at merchants accepting KHQR. The RBI and NBC further state that this linkage will be expanded to allow Cambodian travellers to make UPI QR enabled payments in India at a later date.

The Malta Financial Services Authority (MFSA) has issued a circular regarding the publication of the Conduct of Business Rulebook applicable to Insurance Business and Investment Firms. The MSFA confirms that amendments to Section 4(A) of the Conduct of Business Rulebook concerning the amendments resulting from the transposition of Directive (EU) 2024/2811 will enter into force on June 6, 2026.

On June 3, 2026, the Swiss Financial Market Supervisory Authority (FINMA) published FINMA Supervisory Notice 03/2026 on risks associated with the use of products in individual portfolio management. The notice addresses escalated cases involving asset managers regulated under Article 17 of the Financial Institutions Act (FINIG), which increased significantly over the previous year. FINMA observed that escalated cases — those involving deficiencies reported to the authority — resulted in substantial customer losses and consumed considerable regulatory resources. Through its analysis, FINMA identified recurring risk patterns that warrant industry attention. The notice serves as a reminder to regulated institutions of their obligations when deploying products within individual asset management frameworks and sets out the requirements associated with the use of products in individual portfolio management, including: Requirements pursuant to the Financial Services Act - client-focused conduct requirements. Requirements pursuant to the Financial Services Act - institution-specific risk management requirements. Requirements for the outsourcing of control functions. Financial institutions offering individual asset management services should review the notice to assess their current practices against the identified risk patterns and implement necessary remedial measures to prevent escalation to FINMA.

On June 3, 2026, the Swiss Financial Market Supervisory Authority (FINMA) revoked the asset manager licence of Wendelspiess Partners AG (in liquidation) and imposed a multi-year ban on two individuals for serious violations of conduct rules governing the provision of financial services. FINMA initiated the enforcement proceeding in early 2025 following a report from the competent supervisory organisation indicating that customers of Wendelspiess Partners AG had invested in a foreign fund established and managed by the company since 2021. The investigation found that Wendelspiess Partners AG failed to conduct adequate suitability assessments for its more than 400 customers, who possessed limited to moderate financial knowledge and generally considered themselves risk-averse. FINMA determined that Wendelspiess Partners AG systematically subordinated customer interests to its own interests, constituting serious violations of conduct obligations under the Financial Services Act (FIDLEG). Additionally, the company withheld relevant information during its authorisation process and repeatedly violated its disclosure obligations to FINMA. The decision is not yet final and may be challenged before the Federal Administrative Court by the parties involved.

On June 4, 2026, the Swedish Government Office published a decree amending the Regulation on Investment Funds . The Swedish Financial Supervisory Authority may issue regulations concerning: The translation into Swedish and English of information provided in Sweden by investment firms and management companies. How an investment firm shall publish its intention to cease marketing units. How the investment firm is to publish documents. The risk management system an investment firm must have. Information on management fees. What measures an investment firm must take if it receives funds subject to reporting requirements.

On June 3, 2026, the Malta Financial Services Authority (MFSA) published notice of a settlement agreement of €4,200 with a financial institution following an investigation into supervisory failings. The MFSA's investigation identified several failings of regulatory requirements, including: Failure to submit Annual Audited Financial Statements for the financial years 2022 and 2023 by the stipulated regulatory deadline, as required by Article 17(b) of the Financial Institution Act . Failure to submit the Auditor's Management Letter for the financial year 2022 by the required deadline under Paragraph 35 of the Financial Institution Regulations (FIR/02) . Non-submission of the Auditor's Management Letter for the financial year 2023 by the stipulated deadline under Paragraph 35 of the FIR/02. The MFSA agreed to settle all pending matters with the financial institution following a demonstration of goodwill.

On June 4, 2026, the National Bank of Ukraine (NBU) adopted the Resolution on the Approval of Amendments to the Instructions on the Organisation of Cash Collection and the Transport of Banks' Foreign Currency Assets in Ukraine. The amendments are aimed at ensuring compliance with European Union norms and updated Ukrainian legislation. Key amendments include: The requirements for organising the collection of funds and transportation of currency values have been extended to the financial inclusion bank and its commercial agents. A ban has been established on collection units collecting customer payments on the premises of a bank, collection company or cash processing company, as well as a requirement for collectors of banks to collect self-service software and hardware complexes directly. The requirements for the composition of the collection team in the presence of firearms during the collection have been clarified. The forms of annual reporting for banks have been determined, based on the results of their activities in the collection of funds and transportation of currency values. Banks that have obtained a licence to conduct cash operations and activities relating to the collection of funds shall bring their activities into compliance with this resolution by November 1, 2026. This resolution shall enter into force on the day following its official publication, with the exception of: Paragraphs 12–14 of sub-clause 2 of clause 1, paragraphs 4 and 6 of sub-clause 1, paragraphs 4 and 6 of sub-clause 2 of clause 3, sub-clauses 2, 3 of paragraph 5, subparagraph 1 of paragraph 8, sub-paragraph 3 of paragraph 9, and the second paragraph of sub-paragraphs 3–6 of paragraph 12 of the Amendments, which come into force on June 26, 2026. Sub-paragraph 2 of paragraph 12 of the amendments, which shall enter into force on September 1, 2029.

Banco de Portugal has published a practical guide for credit intermediaries, created to assist in verifying whether their actions comply with the rules applicable to the exercise of the activity. The guide forms part of Banco de Portugal's initiatives to support credit intermediaries in complying with the regulations governing their activity and to ensure that consumers of credit products have access to structured, clear and up-to-date information. The guide presents the rules that credit intermediaries must follow and provides practical examples to support the understanding of the applicable duties. The guide covers: General requirements for accessing the activity and maintaining it at all times. The procedures for amending the details of a credit intermediary's registration. The duties of conduct. The provision of information about credit intermediation activity. The information provided prior to the provision of credit intermediation and consulting services. The complaints book. Alternative dispute resolution. The guide also provides a checklist for credit intermediaries to independently confirm whether they are fulfilling the applicable obligations in the course of their activity.

On June 4, 2026, Finland's Financial Supervisory Authority (Finanssivalvonta) published a thematic assessment examining the marketing of crypto-asset services and products, along with pre-contractual disclosure obligations under consumer protection law. The assessment identified multiple deficiencies in how crypto-asset service providers communicate with consumers, with the most significant gaps relating to risk disclosure and balanced, clear presentation of information. Key findings include: Companies did not adequately and equitably disclose the risks associated with crypto-assets and crypto-asset services. The descriptions gave the impression that all crypto-assets are subject to the same risks. Much of the information to customers was often difficult to find. Not all companies had internal marketing guidelines. The differences between crypto-assets and narratives that create images remained unclear in some cases. Some companies did not provide their customers with the advanced information in person, required under consumer protection legislation. The Financial Supervisory Authority requires that crypto-asset service providers take into account the key findings and take the necessary corrective measures to ensure regulatory compliance.

On June 4, 2026  the Government of South Africa withdrew its draft National Artificial Intelligence (AI) Policy under the Promotion of Access to Information Act (PAIA). The draft policy had previously been made available for public consultation and comment.The withdrawal affects all stakeholders with an interest in AI regulation and governance in South Africa, including technology companies, financial services institutions, telecommunications providers, and other sectors reliant on or developing AI systems.

On June 3, 2026, Europe’s Anti-Money Laundering Authority (AMLA) launched a consultation on draft Guidelines for ongoing monitoring of business relationships under Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation – AMLR). Ongoing monitoring is a key obligation requiring companies and professionals covered by anti-money laundering and counter-terrorism financing (AML/CTF) rules to maintain current understanding of business relationships after establishment, including keeping customer information up to date and monitoring transactions and activities to detect unusual or suspicious behaviour. The draft Guidelines explain in practical terms how to meet ongoing monitoring requirements. They establish core principles applicable across both financial and non-financial sectors, adopting a risk-based and proportionate approach. AMLA is seeking feedback on its consultation by September 3, 2026, which can be submitted via this link .

On February 16, 2026, Romania's National Office for Games of Chance (Oficiul National pentru Jocuri de Noroc, ONJN) issued Supervisory Committee Decision No. 104/16.02.2026, revoking by operation of law the Class II affiliate licence held by Bet Wise S.R.L. Bet Wise S.R.L., registered with tax identification number 50677919 and headquartered in Cluj-Napoca, Romania, held a Class II licence authorising it to conduct affiliate activities for gambling operations. The revocation took effect immediately upon issuance of the decision. The ONJN did not publicly disclose the specific grounds for the licence revocation in the decision notice, though Romanian gambling law permits the ONJN to revoke licences for breach of regulatory obligations or operational requirements. This action reflects the ONJN's ongoing enforcement activity within Romania's regulated gambling market. The ONJN maintains authority over all licensed gambling operators and affiliate entities operating within Romanian jurisdiction. Class II licences in Romania's regulatory framework typically authorise entities to conduct specific gambling-related activities under defined conditions. The revocation of Bet Wise's licence means the entity may no longer legally conduct affiliate operations promoting or facilitating gambling services in Romania. Operators and affiliates holding ONJN licences should ensure continued compliance with all regulatory requirements to avoid similar enforcement action. The ONJN publishes enforcement decisions on its official website, where operators can monitor regulatory developments and licensing status updates. Bet Wise may appeal the revocation decision through administrative channels available under Romanian law.

On June 3, 2026, the New York State Department of Financial Services (DFS) announced it had issued a consent order to Santander Consumer due to the firm's misleading lending practices. Specifically, the DFS found that Santander Consumer imposed undisclosed extension fees on automobile loans in violation of New York banking law. According to the DFS, although Santander Consumer voluntarily ceased charging these undisclosed fees, the practice resulted in New York borrowers paying approximately US$237,000 in unlawful charges. As part of the settlement, Santander Consumer is ordered to pay a US$400,000 penalty and provide more than US$275,000 in restitution to eligible impacted borrowers. Consumers who had an automobile loan with Santander Consumer prior to 2018 will either receive checks to refund their paid fees with interest or receive a waiver of any assessed but unpaid fees.

On June 3, 2026, the Gaming Supervisory Authority under the Ministry of Finance of the Republic of Lithuania published guidelines for the termination of remote gambling contracts. The authority developed these guidelines to establish best practices for the remote gambling sector as the termination of remote gaming contracts is regulated by different legal acts and requires uniform understanding across the industry. The guidelines aim to assist gambling operators in correctly and consistently applying the legal provisions governing the grounds for termination of remote gaming contracts. An unofficial English translation of the guidelines can be accessed here .

On June 3, 2026, the European Supervisory Authorities (ESAs) published a report on major information and communication technology (ICT) related incidents that occurred across the European Union's financial sector during 2025, as mandated by Article 22 of Regulation (EU) 2022/2554 (Digital Operational Resilience Act – DORA). The report documents 3,383 major ICT-related incidents reported in 2025, representing an average of 0.18 major incidents per financial entity subject to DORA. The credit and payments sectors accounted for more than three quarters of all incidents, reflecting their highly digitalised and customer-facing nature rather than sector-specific weaknesses. System failures emerged as the predominant driver, accounting for 51 percent of incidents, followed by external events at 27 percent. Cybersecurity-related incidents represented only 10 percent of the total, suggesting existing safeguards were effective in limiting escalation to major events. Additionally, approximately one third of reported major incidents had cross-border impact, with around 8 percent affecting more than ten member states, underscoring the interconnectedness of the financial system. Nearly 30 percent of major incidents originated from failures attributable to third-party service providers, highlighting the critical importance of robust third-party risk management. Despite the frequency and geographical reach of incidents, two thirds resulted in no or minor disruption to clients and transactions, indicating that timely detection and effective incident response contained operational harm. The report identifies system failures, external events, and third-party dependencies as key supervisory priorities and notes that improved data quality is anticipated as reporting practices consolidate. The ESAs will continue monitoring major incidents and provide additional guidance to competent authorities to enhance supervisory convergence and strengthen the financial sector's operational resilience.

On May 27, 2026, Ukraine's PlayCity Agency (Агентство ПлейСіті) issued Decision No. 204-Р following a scheduled inspection of Limited Liability Company Lemon (ТОВ «ЛІМОН»). The decision documents the results of the inspection and applies financial sanctions in the form of a fine to the operator. The PlayCity Agency conducts routine inspections of gambling operators licensed to operate within Ukraine's regulated gaming market. Scheduled inspections form part of the agency's ongoing state supervision activities to ensure compliance with applicable gambling legislation and regulatory requirements. The issuance of a financial penalty indicates that the inspection identified violations or non-compliance issues during the assessment of Limited Liability Company Lemon's operations. The decision has been published on the PlayCity Agency's official website and is available as a downloadable PDF document. Limited Liability Company Lemon and any affected parties may review the full details of the inspection findings and the basis for the financial sanction through the published decision document. The enforcement of this penalty reflects the PlayCity Agency's commitment to maintaining regulatory standards across Ukraine's gambling sector and ensuring operators adhere to licensing conditions and legal obligations. REFERENCES: PlayCity Agency. Decision No. 204-Р of May 27, 2026, Regarding the Results of a Scheduled Inspection and Application of Financial Sanctions (Fine) to Limited Liability Company Lemon. Available at: https://playcity.gov.ua/

On May 18, 2026, the Australian Prudential Regulation Authority (APRA) issued Banking (prudential standard) determination No. 6 of 2026 under the Banking Act 1959 . It establishes updated rules for how certain Australian banks and financial institutions must publicly report their financial health and risk metrics. The new standard revokes the The standard strictly applies to locally incorporated Significant Financial Institutions (SFIs) and authorised Non-Operating Holding Companies (NOHCs), and not to foreign ADIs, non-SFIs, or purchased payment facility providers. Reporting is required on both a Level 1 (standalone institution) and Level 2 (consolidated group) basis, though group structures generally report at Level 2 to avoid double-ups. APRA mandates that public data must meet five core principles: Clear: Understandable to stakeholders (investors, analysts, and customers) using simple language and structured formatting. Comprehensive: Covering all main activities, significant risks, and qualitative management strategies. Meaningful: Highlighting current and emerging risks while cutting out redundant or obsolete data. Consistent: Allowing stakeholders to track trends across reporting periods. Comparable: Formatted so users can easily compare metrics across different banks and jurisdictions. The standard necessitates some internal controls, including: Institutions must have a formal disclosure policy approved by their Board. An accountable person under the Financial Accountability Regime must formally attest in writing that disclosures comply with company policy. APRA reserves the right to force an independent audit of an institution's disclosures if they suspect the data is misleading. Presentation requirements include: Institutions must maintain a dedicated, easily identifiable "Regulatory Disclosures" section on their website. Data must be provided as a standalone document alongside a CSV or Excel file to allow analysts to download and manipulate the quantitative data. A minimum 12-month digital archive of past disclosures must be publicly accessible. Public reporting must happen concurrently with the lodging of financial reports under the Corporations Act. Rather than inventing an entirely new framework, APRA adopts the international Basel Committee on Banking Supervision (BCBS) Standard. However, the standard also introduces specific Australian modifications to make the global rules fit the local context: All references to Euros in the international standard must be converted to Australian Dollars using a flat multiplier factor of 1.5. Banks must swap out international terms for definitions aligned with Australian standards (e.g., using "non-performing exposures" instead of "defaulted exposures" per APS 220). Australian banks must separately disclose the credit risk exposures of any prudentially regulated New Zealand banking subsidiaries. Institutions can bypass certain global Tier 1 Capital disclosure rows, treating those references strictly as Common Equity Tier 1 (CET1) Capital instead. Banks do not have to follow the BCBS market risk template. Instead, they must provide specific qualitative and quantitative tables outlined by APRA on a semi-annual basis, covering things like Interest Rate Risk and Stressed Value-at-Risk (VaR). SFIs utilizing the minimum liquidity holdings approach under domestic standard APS 210 are exempt from global Liquidity Coverage Ratio (LCR) and Net Stable Funding Ratio (NSFR) templates. This new prudential standard revokes the 2024 version, and is effective as of January 1, 2027.

On May 18, 2026, the Australian Prudential Regulation Authority (APRA) issued Banking (prudential standard) determination No. 6 of 2026 under the Banking Act 1959. The determination came into force on the date of issue and is administered by the Department of the Treasury. The legislative instrument (reference F2026L00591) establishes prudential standards applicable to authorised deposit-taking institutions regulated by APRA. Prudential standard determinations set out specific requirements that banks must meet to maintain financial soundness, manage risks effectively, and protect depositors. These determinations typically address areas including capital adequacy, liquidity management, operational risk, governance frameworks, and reporting obligations. The determination applies to all APRA-regulated banks and authorised deposit-taking institutions that fall within its scope. The instrument is binding and enforceable, requiring affected institutions to comply with the standards outlined within the determination or face regulatory action. The full text of Banking (prudential standard) determination No. 6 of 2026 is available on the Federal Register of Legislation. Banks and deposit-taking institutions should review the determination to understand their obligations and ensure compliance with the new or amended prudential standards it establishes. Institutions may need to adjust their risk management frameworks, reporting processes, or operational procedures to align with the requirements set out in the determination. REFERENCES: Federal Register of Legislation: Banking (prudential standard) determination No. 6 of 2026 https://www.legislation.gov.au/

The Securities and Futures Commission (SFC) of Hong Kong has issued a circular to licensed corporations (LCs), SFC-licensed virtual asset service providers (VATPs), and associated entities regarding enhanced cybersecurity measures to address evolving risks arising from artificial intelligence (AI)-enabled cyberattacks. The circular prescribes: Preparedness and accountability mandating that licensed firms assess their preparedness for AI-enabled cyberattacks and address existing system vulnerabilities. The SFC emphasizes that senior management, particularly the Manager-in-Charge of Information Technology (MIC-IT), is ultimately responsible for managing the firm's cybersecurity risks and ensuring that enhancements are implemented properly and promptly. Patching and vulnerability management requiring firms to enhance and expedite their patch management processes to minimize the window of exposure, given that AI tools can rapidly identify new vulnerabilities. Firms are advised to accelerate the remediation of known vulnerabilities—such as decommissioning legacy systems and replacing unsupported software—and to prioritize patching using a risk-based approach. Incident response and contingency planning advising firms to update their incident handling procedures to clearly define roles, responsibilities, and escalation protocols across all relevant teams (including IT, risk management, and compliance). Firms should also establish pre-authorized containment actions to effectively counter the rapid speed at which AI-assisted attacks can unfold. System and network defenses instructing firms to enhance firewalls and implement micro network segmentation where feasible to limit the lateral movement of threats across networks. Furthermore, firms must treat all external and untrusted inputs as potentially adversarial to prevent them from directly altering system instructions or triggering privileged actions. The SFC notes that these comprehensive measures are particularly expected of LCs engaged in electronic trading, large retail brokers, depositaries of SFC-authorized collective investment schemes (Type 13), and VATPs, while other licensed firms should apply them based on the nature, scale, and complexity of their specific operations.

On June 2, 2026, the Australian Treasury tabled its formal response to the Senate Economics Legislation Committee's inquiry into the Scams Prevention Framework Bill 2024 [Provisions] (SPF). Key highlights of the response were: The Government reaffirmed that scams are a significant and growing threat to Australians and that the SPF is intended to create a coordinated, economy-wide approach to scam prevention. The Government maintained its approach of initially applying the SPF to sectors most frequently used by scammers, i.e., banking, telecommunications, and digital platforms or social media. The Government rejected the idea of a blanket reimbursement regime similar to the UK's authorised push payment (APP) fraud reimbursement model. Instead, compensation will depend on whether a regulated entity has complied with its SPF obligations and whether that failure contributed to consumer loss. The government's response does not introduce any new obligations for firms under the SPF.

The Hong Kong Monetary Authority (HKMA) has issued a Sectoral Code of Practice under the Protection of Critical Infrastructures (Computer Systems) Ordinance (PCICSO) for Authorized Institutions (AIs) designated as Critical Infrastructure (CI) operators. The Code of Practice prescribes: Designation of Critical Computer Systems (CCSs) detailing criteria for designating a system as a CCS, which includes systems that play a material role in core CI functions, systems whose disruption would cause severe impact, and systems storing or processing sensitive digital data for essential services. Organizational obligations (Category 1) mandating that Designated AIs maintain an operational office in Hong Kong, promptly notify the Monetary Authority (MA) of any operator changes (such as ceasing essential services or transferring a banking license), and establish a computer-system security management unit supervised by a qualified professional. Security management plans and notifications (Category 2) requiring AIs to notify the MA of material changes to their CCSs, such as platform migrations, major version upgrades, or significant code changes. Furthermore, AIs must submit and implement a computer-system security management plan endorsed by the Board or senior management and reviewed at least once every two years. This plan must cover robust controls including access and password management, cryptography, physical security, patch management, supply chain management, and cloud computing security. Risk assessments and audits stipulating that Designated AIs must conduct regular computer-system security risk assessments, which must encompass both vulnerability assessments and penetration tests performed by qualified professionals. Additionally, AIs must appoint an assessor to conduct computer-system security audits to evaluate whether the security management plan is properly implemented and whether the security controls adhere to the Code's guidance. The code takes immediate effect.

On June 3, 2026, the National Bank of Ukraine announced the issuance of a warning to Royal Finance for conduct of business violations. The violations occurred under the following regulations: Regulations on the authorisation of financial service providers and the conditions for their provision of financial services . Regulations on requirements for the corporate governance system and internal control system of a financial company . Royal Finance is obliged to eliminate the violations and shortcomings in its activities within the specified time limits.

The Hong Kong Monetary Authority (HKMA) has issued a circular reminding Authorized Institutions (AIs) to strengthen their cyber defenses in response to evolving global cyber risks, particularly those empowered by frontier Artificial Intelligence (A.I.) models. The circular prescribes: Cyber defense control assessments requiring AIs to evaluate whether their multi-layered defenses (such as defense-in-depth, zero trust architecture, and patching protocols) remain fit-for-purpose against accelerated, assisted zero-day exploits. AIs must also assess the cyber resilience of third-party service providers to mitigate supply chain risks. Incident response and recovery uplifts mandating that AIs review the readiness of their playbooks and processes for breach scenarios. AIs should perform suitable scenario testing within their operational resilience programs and ensure dependent third parties are sufficiently resourced. Data resilience enhancements instructing AIs to improve their Secure Tertiary Data Backup (STDB) arrangements, or to reconsider implementing an STDB if they have not yet done so, to counter destructive attacks. Task force and testing framework initiatives announcing the establishment of a Task Force on A.I.-Driven Cyber Risks to share cross-jurisdictional intelligence and counter information asymmetry. Additionally, the HKMA is developing a Cyber Resilience Testing Framework (CRTF) focused on response and recovery capabilities, with an initial test run planned for late 2026. Critical infrastructure ordinance compliance supporting the implementation of the Protection of Critical Infrastructures (Computer Systems) Ordinance (PCICSO). To guide designated critical infrastructure operators within the banking sector, the Monetary Authority (MA) entered into a Memorandum of Understanding (MoU) with the relevant Commissioner and issued a Sectoral Code of Practice (CoP), which came into operation on June 2, 2026..

The Hong Kong Monetary Authority (HKMA) has issued a circular providing an update on paragraph 2.6.4 of the Supervisory Policy Manual (SPM) module CRP-1 regarding the "classification of cryptoassets". The circular prescribes: Cryptoassets classification update clarifying the additional conditions required for a Group 1 classification of tokenized traditional assets operating on a permissionless blockchain. Regulatory oversight clarification stipulating that the requirement for a tokenized instrument to be approved by a financial market regulator can also be considered satisfied if the associated business activities are supervised by a financial market regulator. This recognizes that while certain tokenization arrangements on permissionless blockchains do not need explicit prior approval, they remain subject to appropriate regulatory oversight. The update is effective immediately

On June 3, 2026, the Office of the Government of the Republic of Slovenia for Information Security (URSIV) published guidelines for reporting information security incidents under the Information Security Act (ZInfV-1). Key points include: Determining whether an incident has occurred: it is necessary to check whether an event has taken place that has compromised the confidentiality, integrity, availability or authenticity of stored or processed data. Assessing the impact of the incident: based on the impact, the severity of the incident is then assessed in accordance with the scale established by the firm. Reporting of significant incidents: firms may voluntarily report all other incidents, cyber threats, near-incidents and vulnerabilities to the Computer Security Incident Response Team (CSIRT). Essential and significant firms must send an early notification of a significant incident immediately, or at the latest within 24 hours of detection. Incident reports should be sent via email to cer@cert.si .

On June 3, 2026, the Japanese Bankers Association (JBA) submitted comments to the European Commission regarding the draft revised European Sustainability Reporting Standards (ESRS) , released on May 6, 2026. The association welcomed the proposed simplifications, including the introduction of a top-down approach and clearer limitations on disclosure of immaterial information. The JBA's feedback included: Concerns regarding alignment with internationally recognised sustainability reporting standards issued by the International Sustainability Standards Board (ISSB). Discrepancies between the ESRS and ISSB Standards may create additional disclosure burdens for reporting entities operating under both frameworks. Proposals that disclosures extending beyond the scope of ISSB Standards be made voluntary as a general principle as under ISSB Standards, entities are required to disclose material risks and opportunities but not necessarily the detailed processes used to identify them.

On June 3, 2026, the Japan Virtual Currency Exchange Association (JVCEA) published new draft rules and guidelines on system governance for crypto asset exchange businesses for public consultation. The draft documents propose the establishment of a new overarching system governance framework alongside amendments to four existing sets of rules and guidelines governing system risk management, emergency response, information security management, and user asset management for crypto asset exchange businesses. Proposed new rules and amendments have been made to: Rules and Guidelines on System Governance for Crypto Asset Exchange Businesses : Carved out from the existing System Risk Management Rules and consolidates provisions that senior management are considered particularly responsible for overseeing. It establishes a dedicated governance-level framework for system and cybersecurity risk, separate from operational-level system risk management requirements. Rules and Guidelines on System Risk Management for Crypto Asset Exchange Businesses : Provisions relating to senior management responsibilities are extracted into the new System Governance Rules above. Rules and Guidelines on Emergency Response for Crypto Asset Exchange Businesses : Incorporates relevant content from the FSA's Cybersecurity Guidelines for the Financial Sector and has been updated to clarify the documents and standards that members should reference when identifying and assessing the risk of crypto asset outflows and similar incidents. Rules and Guidelines on Information Security Management for Crypto Asset Exchange Businesses : Incorporates relevant content from the FSA's Cybersecurity Guidelines for the Financial Sector , strengthening information security requirements in line with current cybersecurity standards. Guidelines on the Rules on Management of User Assets for Crypto Asset Exchange Businesses : Clarifies the specific documents and standards that members must refer to when identifying and assessing risks related to the outflow of crypto assets and other user asset risks. Stakeholders and interested parties are invited to submit comments on the draft rules and guidelines to public@jvcea.or.jp by June 15, 2026 at 15:00 JST, or by post to JVCEA's Tokyo office.

On June 2, 2026, the European Securities and Markets Authority (ESMA) published a letter to the European Commission outlining its prioritisation of 2026 deliverables in response to new legal mandates and external factors affecting its workload. ESMA's letter details how the authority is reallocating resources to manage competing demands while maintaining supervisory effectiveness. ESMA identified several factors driving its prioritisation exercise: The publication of the Market Integration and Supervision Package (MISP) proposal The European Commission's political priority towards simplification and burden reduction. To avoid imposing multiple, potentially inconsistent changes on financial market participants, ESMA postponed public consultations on planned policy deliverables that could be altered by the MISP package's final legislative outcome. ESMA also deprioritised a short list of reports with limited added value due to insufficient new data or interactions with the MISP package. Resources freed from postponing these deliverables will be directed towards ESMA's highest priority workstreams for 2026, including: Preparation for supervision and authorisation of consolidated tape providers and ESG rating providers. Simplification and burden reduction in data reporting. T+1 settlement preparation. Convergence actions supporting crypto. Tokenisation impact assessments.

On June 3, 2026, the European Commission published Delegated Regulation (EU) 2026/440 in the Official Journal of the European Union. The delegated regulation amends Delegated Regulation (EU) 2015/63 , supplementing Directive 2014/59/EU (Bank Recovery and Resolution Directive – BRRD), regarding the calculation of contributions to resolution financing arrangements. In particular, the Delegated Regulation has been adopted to account for the amendments introduced by Directive (EU) 2019/2034 (Investment Firms Directive – IFD) and Regulation (EU) 2019/2033 (Investment Firms Regulation – IFR). The amendment introduces a simplified contribution methodology for certain investment firms with total consolidated assets below specified thresholds. These firms, which are no longer subject to capital and liquidity requirements under the IFD and IFR, will calculate contributions based solely on size (basic annual contribution) rather than additional risk factors. Investment firms may request application of the full risk adjustment methodology if it results in lower contributions. The Delegated Regulation enters into force on June 6, 2026, 3 days after its publication in the Official Journal of the European Union. It applies on January 1, 2026, however: Article 1, points (5) and (9) apply from January 1, 2027. Article 1, point (10) apply from June 6, 2026.

On June 2, 2026, the Louisiana Legislature enacted SB 254 , which creates Chapter 52 of Title 51 of the Louisiana Revised Statutes regarding the protection of consumers from debit card surcharges. The law prohibits a retail business from imposing an additional surcharge on a cardholder who uses a debit card instead of cash, check credit card or similar means of payment. Specifically, this prohibition applies to any sale of goods or services, with retail businesses found in violation liable to the cardholder for actual damages incurred. The law stipulates that the cardholder must provide written notice of the alleged violation to the retail business prior to filing a lawsuit. The retail business may cure the violation and reimburse the assessed surcharge within 30 days of receiving the notice to avoid a private right of action. The private right of action only applies to willful violations, repeated violations or violations that remain uncured after the provided time period. Additionally, the law clarifies that the Louisiana Office of the Attorney General (OAG) is authorized to bring civil actions to enforce its provisions, with violators subject to civil penalties of up to US$500 per violation. The law also requires the OAG to establish and maintain a toll-free telephone number and an electronic reporting system for cardholders, noting that collected penalty funds must be used to promote consumer protection and education. The law takes effect on August 1, 2026 .

On June 2, 2026, the US Federal Deposit Insurance Corporation (FDIC), the Office of the Comptroller of the Currency (OCC), and the Board of Governors of the Federal Reserve System jointly removed references to reputation risk from multiple interagency supervisory guidance documents. This action complements a final rule published on April 10, 2026, which codified the elimination of reputation risk from the agencies' supervisory programs. According to the FDIC's announcement , the agencies removed reputation risk references to prevent misuse of supervisory authority that could restrict individuals' and legal businesses' access to financial services based on constitutionally protected political or religious beliefs, speech, conduct, or lawful business activities. By eliminating these references, the agencies ensure supervisory decisions are grounded in material financial risks and increase clarity and precision in supervisory decision-making. The updated documents span multiple risk areas, including asset securitization, subprime lending, customer identification programs, counterparty credit risk management, cybersecurity, operational resilience, and elder financial exploitation. The agencies also updated guidance on cyber insurance, cyberattacks involving extortion, and sales of 100 percent loan participations. The FDIC-supervised financial institutions must apply these updates to their supervisory frameworks. The agencies continue to review additional supervisory materials and may update further documents as appropriate. This initiative reflects a broader effort to align supervisory guidance with the prohibition on using reputation risk in regulatory decision-making, ensuring that examination procedures and manual updates reflect material financial risk considerations only.

[Auto-generated content is not available for this article. Please write the update manually based on the source.]

On June 2, 2026, the US Federal Reserve Board (FRB), US Federal Deposit Insurance Corporation (FDIC) and US Office of the Comptroller of the Currency (OCC) announced the removal of additional references to reputation risk from certain interagency documents. The agencies are taking this action to complement earlier actions that ended the use of reputation risk in broader supervision efforts. The agencies have previously expressed that reputation risk can be misused by regulators as a basis to encourage or pressure a bank to restrict individuals' and legal businesses' access to financial services due to their constitutionally protected political or religious beliefs, speech or conduct. As such, according to the FRB, this action helps ensure supervisory decisions are based on material financial risks, and that they are designed to increase clarity and facilitate greater precision in supervisory decisionmaking.

On June 2, 2026 the New York State Department of Financial Services (DFS) announced the execution of a memorandum of understanding (MOU) with the European Banking Authority (EBA) to facilitate the exchange of supervisory and confidential information related to cross-border stablecoins activity. According to the DFS, the MOU is intended to enhance the supervision of entities engaged in stablecoin activities, identify market trends and risks and promote the integrity of the broader, international stablecoin market. The DFS has supervised stablecoin issuance since 2018. Regulated entities that are approved to issue stablecoins in New York State are subject to the DFS' stablecoin supervisory framework, which includes strong reserve requirements, confidence in redeemability, transparency and a prohibition on rehypothecation.

On June 2, 2026, the US Securities and Exchange Commission (SEC) published its draft Strategic Plan for fiscal years 2026–2030 and launched a public consultation on the agency’s future regulatory priorities. The draft plan sets out the following strategic goals: supporting innovation, capital formation, market efficiency and investor protection; increasing stakeholder engagement and facilitating compliance; and improving operational efficiency through organizational and technology modernization. Under the first goal, the SEC proposes establishing a clearer regulatory framework for digital assets and distributed ledger technologies. The draft plan highlights the need to clarify the application of securities laws to digital assets, support compliant tokenized offerings, enable on-chain financial infrastructure and address jurisdictional questions between the SEC and the Commodity Futures Trading Commission. The draft plan also signals a shift in regulatory practice toward greater engagement with market participants and a renewed focus on enforcement actions involving fraud, deception and market manipulation. The SEC states that enforcement should focus on violations of established law and that existing rules should be subject to periodic retrospective review to assess whether they remain effective and proportionate. In addition, the SEC proposes a review and modernization of its technology infrastructure, including the Electronic Data Gathering, Analysis and Retrieval (EDGAR) system, and identifies the responsible use of artificial intelligence and blockchain technologies as tools to improve regulatory oversight, operational efficiency and data management. The consultation forms part of the SEC’s strategic planning process and provides insight into the regulatory priorities expected to shape the agency’s activities between 2026 and 2030. Interested stakeholders may submit comments to the SEC until July 2, 2026.

The Hong Kong Securities and Futures Commission (SFC) has fined XHK Limited HK$2.5 million (US$320,000) after the firm exhibited inadequate internal controls regarding the preparation of financial returns and the handling of client funds. The SFC’s investigation found that, between February 2019 and October 2021, XHK failed to implement effective safeguards for: Ensuring the competency of external service providers appointed to prepare financial returns, Maintaining the required liquid capital without falling into deficit, Obtaining written directions or standing authority before transferring client money to overseas brokers, and Promptly transferring non-client money (such as commissions and interest) out of segregated client accounts. These deficiencies breached the Securities and Futures (Financial Resources) Rules (FRR), the Securities and Futures (Client Money) Rules (CMR), and the Code of Conduct, resulting in required liquid capital deficits of up to HK$32.3 million (US$4.1 million) and the improper transfer of HK$206 million (US$26.4 million) in client money.

On May 2026, the Financial Industry Regulatory Authority (FINRA) launched a targeted review of firm practices relating to the supervision of non-principal protected “worst-of” structured notes, a higher-risk category of structured products whose performance depends on the worst-performing asset within a basket of reference assets. As part of the review, FINRA is examining how firms ensure compliance with Regulation Best Interest (Reg BI), including the care and conflict of interest obligations, and applicable FINRA rules when recommending such products to retail customers. The review requests information covering the period from January 1, 2022 to December 31, 2025, including firms' written supervisory procedures for structured products, product risk classifications, sales restrictions, concentration limits, supervisory alerts, representative training requirements, compensation arrangements and conflict-of-interest controls. FINRA is also seeking information on customer disclosures relating to structured notes, including information provided to customers regarding product risks and compensation received by firms and registered representatives from the sale of such products. The review indicates ongoing supervisory scrutiny of firms' governance, suitability and conflict-management practices when recommending complex structured products to retail investors, particularly where concentrated customer exposure may create heightened investor protection risks.

The Bank of Thailand (BOT) has issued two circulars, Circular No. 23/2026 and Circular No. 24/2026, aimed at standardizing service fees and modifying the rules around credit card operations. The notifications prescribe: Standardization of fees (Circular 23/2026) establishing uniform criteria for charging fees for basic financial services, including products related to deposit accounts, electronic cards, payment transactions, and SME lending. This standardization aims to ensure fees align more closely with actual costs, which have in some cases decreased due to technological advancements, thereby reducing the burden on consumers and promoting fairness. Credit card cash withdrawal fees (Circular 24/2026) repealing the previous rule (clause 5.4.3 (2) of BOT Notification No. SorNorSor. 11/2563) regarding the maximum fees that can be charged for credit card cash withdrawals. The new rule stipulates that any fees and expenses charged for cash withdrawals—in addition to interest, penalties, and service charges—must not exceed the rates specified in the new BOT Notification on standardizing service fees (Circular 23/2026). The circulars take effect on June 2, 2026.

On June 2, 2026, the US Office of Foreign Assets Control (OFAC) designated Nobitex, Iran’s largest digital asset exchange, along with three other Iranian digital asset exchanges, as part of its "Economic Fury" campaign and the Trump administration’s wider efforts to eliminate threats posed by the Iranian regime. According to OFAC , Nobitex provides significant support to the regime, processing more than 50 percent of all Iranian digital asset inflows in 2025, as well as facilitating payments linked to Iran’s terrorist activities, sanctions evasion efforts and Islamic Revolutionary Guard Corps (IRGC)-related transactions, including activity associated with IRGC-affiliated ransomware actors. The designations are being taken pursuant to OFAC's counterterrorism authority under Executive Order 13224 , as well as Executive Order 13902 , which targets individuals and entities operating in Iran’s financial sector. The designations block all US-based property of these targets and generally prohibit US individuals and entities from engaging in transactions with them, unless expressly authorized by OFAC. Additionally, OFAC has issued an Iran-related frequently asked question (FAQ) document on the subject of Iranian digital asset exchanges: FAQ 1257 .

On June 2, 2026, the US Office of Foreign Assets Control (OFAC) designated rebel commanders operating in the Democratic Republic of the Congo (DRC) from the Democratic Forces for the Liberation of Rwanda (FDLR) and the Rwanda-backed March 23 Movement (M23). According to OFAC , FDLR and M23 are US and United Nations (UN)-designated armed groups with long histories of human rights abuse and regional destabilization. As such, the designations are being taken pursuant to OFAC's DRC-related sanctions authority under Executive Order 13413 , due to these groups committing serious violations of international law. The designations block all US-based property of these targets and generally prohibit US individuals and entities from engaging in transactions with them, unless expressly authorized by OFAC.

On June 2, 2026, the Tennessee Department of Financial Institutions (DFI) announced the maximum effective rate of interest for home loans for the month of July 2026: 10.52 percent per annum.

On June 2, 2026, the Australian Prudential Regulation Authority (APRA) finalised FAQs for Minimum Liquidity Holding (MLH) Authorised Deposit-Taking institutions (ADIs) addressing the liquidity treatment of deposits placed with settlement service providers (SSPs), under Prudential Standard APS 210 Liquidity (APS 210) . APRA has clarified that deposits placed by ADIs with settlement service providers to secure settlement obligations are considered encumbered. As these minimum security deposits remain under the control of the SSP to mitigate credit risk in the event of an ADI's default, they cannot be relied upon in a stress scenario. Consequently, they cannot be counted as MLH liquid assets. Recognising that this strict definition may require ADIs to find alternative liquid assets, APRA has extended the transition timeline. ADIs are expected to report their liquidity in line with this finalised FAQ starting with their December 31, 2026, quarterly reporting. Resubmission of historical liquidity reports will not be required.