Published

The Australian Securities and Investments Commission (ASIC) will end its no-action position for digital asset service providers on 30 June 2026, requiring firms to have applied for an Australian Financial Services (AFS) licence or a variation to their existing licence by this date. The no-action position was granted to enable providers to consider the guidance and apply for new or varied licences. After the 30 June deadline, firms operating without a licence can face fines of up to 10% of their annual turnover and potential civil/criminal consequences. Businesses requiring an Australian Market Licence or a Clearing and Settlement (CS) facility licence must notify ASIC in writing and hold a pre-meeting with the regulator by the deadline.

On May 4, 2026, the European Payments Council (EPC) published version 1.1.1 of the verification of payee (VOP) scheme inter-payment service provider (PSP) application programming interface (API) specifications. The updated specifications address technical issues and clarifications required to support consistent implementation of VOP-related APIs across the inter-PSP space. Key changes in version 1.1.1 include: Restrictions on empty API fields to align with established standards. Clarifications regarding character set requirements for VOP APIs. Clarifications on timestamp handling. Clarifications on HTTP headers, including content-type handling. T These amendments aim to resolve deployment issues that emerged following the VOP scheme's launch and to provide greater clarity on specific elements of the VOP scheme rulebook, API specifications and API Security Framework (ASF). Version 1.1.1 will become effective on September 20, 2026.

On May 4, 2026, the Central Bank of Iceland (CBI) issued a circular to supervised entities addressing the cybersecurity implications of artificial intelligence (AI), particularly large language models, on financial market participants. The central bank highlights that threat actors are increasingly leveraging AI to identify system vulnerabilities and automate attacks with unprecedented speed and efficiency. Advanced AI models can discover previously unknown zero-day vulnerabilities and chain them into complex attack sequences, reducing the time available for organisations to respond to emerging threats. This development creates a potential gap between attackers' ability to exploit vulnerabilities and organisations' capacity to detect and remediate them. The guidance references Regulation (EU) 2022/2554 (Digital Operational Resilience Act – DORA), which entered into force in Iceland through Act No. 78/2025 , as providing a framework to address these risks. The central bank directs supervised entities to: Maintain robust foundational security practices, including timely security updates, secure access controls and regular access reviews. Ensure clear visibility and regular updates of information and communication technology systems and their exposure. Enhance monitoring and analysis capabilities to detect anomalies earlier and respond faster. Prioritise vulnerability remediation and automate responses where appropriate - maintain clear, documented and regularly tested incident response procedures. Assess risks from service providers and third parties through regular reviews and oversight. Evaluate how AI can support their own security operations, including vulnerability detection and anomaly monitoring. Establish clear policies governing AI usage, including data handling and information security considerations. Enhance staff awareness training regarding AI-enabled threats, including deepfakes and social engineering. Conduct business impact analyses for various scenarios and adjust security measures accordingly.

On May 4, 2026, the European Securities and Markets Authority (ESMA) published an interim report on its call for evidence (CfE) on a comprehensive approach for the simplification of financial transaction reporting. As explained by ESMA, on June 30, 2025, it launched a CfE seeking input to identify major cost drivers and collect views on how to best work towards a comprehensive review for the simplification of financial transaction reporting. This interim report provides a summary of the feedback received during the consultation process. Serving as an intermediate milestone, it precedes the formulation and publication of final recommendations for policymakers, which will be detailed in the forthcoming final report. The interim report examines current financial transaction reporting frameworks and identifies areas where simplification could be achieved without compromising regulatory objectives or market transparency. The report addresses key themes including the fragmentation of reporting requirements across different regulatory regimes, the technical complexity of existing reporting systems and opportunities for greater standardisation. Following the publication of this interim report, ESMA will submit its final report to the European Commission by July 2026.

On May 4, 2026, the European Securities and Markets Authority (ESMA) published its final report on the integrated collection of funds' data. The report outlines ESMA's recommendations for developing a feasible and proportionate integrated reporting system for investment funds across the European Union under Directive 2011/61/EU (Alternative Investment Fund Managers Directive – AIFMD) and Directive 2009/65/EC (Undertakings for Collective Investments in Transferable Securities (UCTIS). It identifies significant fragmentation in the current reporting landscape, with overlapping and duplicative requirements across multiple EU-level and national frameworks. ESMA recommends establishing a single, modular and dynamic reporting template to replace fragmented regimes, supported by a common regulatory data dictionary with harmonised semantics. The proposed architecture would maintain national data collection while transmitting all reported information to a centralised EU-level hub operated by ESMA, enabling centralised validation, data sharing and analytics. The implementation will follow a phased approach. Phase 1 will consolidate AIFMD and UCITS supervisory reporting requirements, with ESMA targeting draft regulatory technical standards (RTS) and implementing technical standards (ITS) by April 2027. Phase 2 will extend integration to and statistical reporting frameworks. ESMA anticipates Phase 1 implementation by 2029 at the earliest, contingent on timely European Commission adoption and stakeholder adaptation.

On May 4, 2026, the Norwegian government published the Regulations amending the Regulations to the Act on the disclosure of sustainability information in the financial sector. The regulations adopt three EU regulations, namely: Commission Delegated Regulation (EU) 2021/2178 . Commission Delegated Regulation (EU) 2021/2139. Commission Delegated Regulation (EU) 2023/2486 . The regulations enter into force immediately.

On May 5, 2026, the National Bank of Ukraine adopted the Resolution on the Approval of Amendments to the Rules for the Preparation and Submission of Reports by Participants in the Non-Bank Financial Services Market to the National Bank of Ukraine. Key amendments include: Lending providers shall submit the LRF01 file "Regulatory Balance Sheet Data" to the National Bank of Ukraine from September 1, 2026. The resolution focuses on updating the reporting framework applicable to lending providers, including changes to reporting formats, terminology and electronic signature requirements. The resolution introduces new reporting forms relating to: Capital revaluations of government securities and other financial instruments. Exchange differences on authorised capital contributions. Capital revaluations of government securities and other financial instruments. Exchange differences on authorised capital contributions. This resolution shall enter into force on the day following its official publication, except for paragraph 5, which shall enter into force on August 1, 2026.

On May 4, 2026, the Cyprus Securities and Exchange Commission (CySEC) issued Circular C775 requiring all listed companies to submit information for the risk-based supervision framework (RBSF) for the year 2025. The circular applies to two categories of listed companies: Local listed companies with securities listed on the Cyprus Stock Exchange whose home member state is Cyprus. International listed companies with securities listed on a regulated market in an European Economic Area (EEA) country whose home member state is Cyprus. Listed companies must complete and submit Form RBSF-LLC (for local listed companies) or Form RBSF-ILC (for international listed companies) electronically via CySEC's Transaction Reporting System (TRS) by May 29, 2026. The forms must be completed based on audited financial statements for the reporting period January 1 to December 31, 2025, using December 31, 2025 as the reference date. Listed companies may submit queries regarding form completion until May 22, 2026, via email to riskstatistics.listedcos@cysec.gov.cy or by telephone on 22-506600. Technical queries on digital signing and submission should be directed to information.technology@cysec.gov.cy.

On April 5, 2026, the Central Bank of Russia (CBR) issued an information letter providing recommendations to credit institutions and head credit institutions of banking groups regarding auditor confirmation procedures for applying phased deductions of intangible assets (IA) in calculating own funds (capital). The recommendations implement a Board of Directors decision from February 27, 2026, concerning the phased deduction of intangible assets for capital adequacy calculations. Credit institutions must obtain auditor confirmation from registered audit organisations verifying that intangible assets meet specified conditions and that phased deduction calculations are correct as of the audit date. The audit confirmation must be prepared in accordance with International Standard on Assurance Engagements 3000 (revised) and cover all intangible assets to which phased deduction applies. Key audit areas include: verification of software's status as critical information infrastructure assets; confirmation of procurement compliance with internal regulatory documents or Federal Law No. 223-FZ for state-owned institutions; validation of software development cost capitalisation; confirmation of asset deployment into operational use; and verification of phased deduction calculations. Audit organisations must have completed at least 20 annual audits of credit institutions' financial statements within the preceding five years and be registered with the CBR as auditors serving publicly significant financial market organisations under Part 3 of Article 5.1 of Federal Law No. 307-FZ "On Audit Activity" (December 30, 2008).

On May 4, 2026, the Hungarian National Bank (MNB) issued recommendations to crypto-asset service providers regarding compliance requirements for crypto-asset services and expectations for crypto-asset transfer services. Specifically, the MNB published two documents: Recommendation No. 4/2026 on procedures and rules regarding crypto-asset transfer services pursuant to the Regulation on crypto-asset markets. Recommendation No. 5/2026 on certain aspects of compliance requirements and on the format of periodic reports relating to portfolio management activities. The recommendations require crypto-asset service providers to give clients clear, transparent information about the risk assessment process conducted before providing portfolio management or advisory services. Providers must explain why information is requested, maintain data currency and review assessments at least every two years. Where necessary data is absent, providers cannot recommend crypto-asset services or products. The MNB expects providers to clearly document their responsibility for recommending appropriate crypto products and services based on assessment results. The MNB expects service providers to implement these recommendations by October 1, 2026.

On May 5, 2026, the Central Bank of Russia (CBR) launched a consultation on the Draft Bank of Russia Instruction "On Amending Bank of Russia Instruction No.4466-U of July 12, 2017 on the Methodology for the Bank of Russia's Assessment of the Sufficiency of a Bank's Assets to Settle Its Obligations". Key points include: When determining the amount of the provision formed, where a borrower has been granted several loans, the specific provisions for the formation of loan provisions set out in clause 4.1 of CBR Regulation No.590-P shall apply. Investments in digital financial assets shall be valued at carrying amount. The value of digital financial assets is adjusted by 100 percent of the carrying amount, taking into account the provision for possible losses formed by the bank or the accrued revaluation in cases where: There is no confirmation of rights to the relevant type of digital financial asset. The financial position of the issuer and counterparty of the digital financial asset is assessed as poor, taking into account the requirements of paragraphs 3.3 to 3.5 of CBR Regulation No.590-P. There is no confirmation of rights to the relevant type of digital financial asset. The financial position of the issuer and counterparty of the digital financial asset is assessed as poor, taking into account the requirements of paragraphs 3.3 to 3.5 of CBR Regulation No.590-P. Comments and feedback are welcome up until May 17, 2026, and can be sent via email to egorovava@cbr.ru .

On May 5, 2026, the Central Bank of Russia (CBR) launched a consultation on the Draft Bank of Russia Instruction "On Amending Bank of Russia Instruction No.3707-U of June 30, 2015 on the Methodology for Assessing by Representatives of the CBR and the State Corporation Deposit Insurance Agency the Adequacy of a Bank's Assets to Settle Its Obligations". Key proposed amendments include: When determining the amount of the provision formed, where a borrower has been granted several loans, the specific provision for the formation of loan provisions set out in paragraph 4.1 of Bank of Russia Regulation No.590-P shall apply. Investment in digital financial assets shall be valued at carrying amount. The value of digital financial assets is adjusted by 100 percent of the carrying amount, taking into account the provision for possible loans formed by the bank or the accrued revaluation in cases where: There is no confirmation of rights to the relevant type of digital financial asset. The financial position of the issuer and counterparty of the digital financial asset is assessed as poor, taking into account the requirements of paragraphs 3.3 to 3.5 of Regulation No.590-P. There is no confirmation of rights to the relevant type of digital financial asset. The financial position of the issuer and counterparty of the digital financial asset is assessed as poor, taking into account the requirements of paragraphs 3.3 to 3.5 of Regulation No.590-P. Comments and feedback are welcome up until May 17, 2026 and can be sent via email to egorovava@cbr.ru .

On May 4, 2026, the National Bank of Ukraine (NBU) imposed enforcement measures against NovaPay for violations of Ukrainian payment services legislation and consumer protection laws. The NBU's Inspection Department conducted a scheduled inspection of NovaPay between September and November 2025. The inspection identified multiple breaches of payment services regulations and consumer protection requirements. The NBU imposed two separate fines totalling UAH7,999,059.19 (approximately €156,000). The first fine of UAH4,882,959.19 (approximately €95,000) addressed violations of the Law on Payment Services, the Instruction on Cash Operations and Payment Transactions by Payment Service Providers (NBU Board Resolution 103/2018), the Instruction on Opening and Closing Accounts (NBU Board Resolution 162/2022), and Rules on Storage, Protection, Use and Disclosure of Payment Service Provider Secrets (NBU Board Resolution 147/2022). The second fine of UAH3,116,100 (approximately €61,000) addressed violations of the Law on Payment Services, the Law on Consumer Lending, and the Regulation on Additional Requirements for Payment Service Contracts with Consumers (NBU Board Resolution 233/2022). Additionally, the NBU issued a written warning requiring the company to implement corrective measures to prevent future violations by June 25, 2026.

On May 5, 2026, the National Bank of Ukraine (NBU) applied restrictive measures against Interway Capital, suspending certain activities until December 31, 2026. Interway Capital was found to be engaged in risky activities that threatened the interests of their clients and creditors. In particular, the company was engaged in activities to provide funds to other persons under the terms of a repayable financial assistance agreement with the right to provide lending services. The detection of risky activities threatened clients' and creditors' interests.

On May 5, 2026, the Austrian Financial Market Authority (FMA) announced it had imposed a fine of €60,000 to Sparkasse Oberösterreich Bank AG for breaches of anti-money laundering and counter-terrorism financing obligations. The FMA found that Sparkasse Oberösterreich Bank had failed to establish adequate policies and procedures for customer due diligence and committed the following breaches: Failure to develop written policies and procedures to ensure appropriate understanding of customers' ownership and control structures. Failure to apply procedures to ensure appropriate understanding of customers' ownership and control structures on an ongoing basis. Failure to ensure regular updates of all information, data, and documents required under the Financial Markets Anti-Money Laundering Act. As a resut of these breaches, the fine was issued.The penal order is final and not subject to further appeal.

On May 4, 2026, the Dutch National Bank (DNB) published its Annual Report for 2025. The report provides a comprehensive overview of DNB's activities, operations, and strategic priorities throughout the financial year. The annual report includes detailed information on DNB's role as the central bank and financial regulator of the Netherlands, covering its responsibilities in monetary policy, financial stability, and prudential supervision.

On May 1, 2026, the National Bank of Ukraine (NBU) Board adopted Decision No. 134-рш, which amends the technical specifications for conducting stress testing assessments of banks and the Ukrainian banking system in 2026. The decision modifies the existing technical framework that governs how the NBU evaluates the resilience and stability of individual banks and the broader banking sector. Stress testing is a critical supervisory tool used to assess whether banks maintain adequate capital and liquidity buffers to withstand adverse economic scenarios. By updating the technical specifications, the NBU ensures that its 2026 stress testing methodology reflects current market conditions, regulatory developments, and emerging risks within the Ukrainian financial system. The amended technical specifications will apply to all banks subject to NBU supervision and will guide the conduct of stress testing exercises throughout 2026. This update is part of the NBU's ongoing efforts to strengthen banking sector oversight and maintain financial stability in Ukraine. The full text of Decision No. 134-рш is available on the NBU's official website in PDF and DOCX formats.

On May 4, 2026, the Ohio Casino Control Commission (OCCC) proposed an amendment to Ohio sports gaming funding account requirements, which would prohibit use of credit cards for such purposes. Specifically, the proposal would amend Rule 3775-16-03 to remove the ability of patrons to fund their sports gaming accounts through the use of credit or debit cards. Interested stakeholders may submit written comments to the OCCC at rulecomments@casinocontrol.ohio.gov by 5:00pm on May 15, 2026 .

On May 4, 2026, the Florida Office of Financial Regulation (OFR) issued a final order approving a stipulation and consent agreement with Wahneta Discount Foods Inc. (Wahneta), a licensed money services business. The agreement resolves violations identified during an examination covering July 2019 through June 2021, related to bank account reporting, payment instrument logs and authorized signatories under Chapter 560 of the Florida Statutes . Key findings of the OFR include: Failure to timely report bank account changes. Wahneta failed to report the closing and/or opening of bank accounts as required. Failure to maintain a complete returned payment instrument log. Wahneta failed to keep a complete log of returned payment instruments. Failure to maintain a bank account with authorized signatories. Wahneta failed to maintain a bank account with properly designated authorized signatories. The OFR imposed an administrative fine of $5,500 against Wahneta and the business agreed to future compliance with Chapter 560.

On May 4, 2026, the US Office of Foreign Assets Control (OFAC) issued Venezuela-related General License 5W , which authorizes certain transactions related to the Petróleos de Venezuela SA (PDSA) 2020 8.5 percent bond, permitting specified transactions involving the Venezuelan state-owned oil company's bond instruments. Additionally, OFAC amended its Venezuela-related frequently asked questions (FAQs), through FAQ 595 , to provide updated guidance on sanctions compliance matters. Specifically, the amended FAQs clarify regulatory expectations and procedural requirements for entities engaging in permitted transactions related to PDSA under the new general license.

On May 4, 2026, the Commodity Futures Trading Commission (CFTC)  issued Supplemental No-Action Letter No. 26-13, expanding prior no-action relief relating to swap data reporting and recordkeeping requirements for certain fully collateralized event contract transactions executed on or subject to the rules of Railbird Exchange, LLC. The supplemental letter modifies CFTC Letter No. 25-26 to include Bitnomial Clearinghouse, LLC as an approved derivatives clearing organization (DCO) covered by the existing no-action position, replacing QC Clearing LLC as Railbird’s primary clearing provider. The relief applies to Railbird, Bitnomial and their market participants in relation to certain swap-related reporting and recordkeeping obligations under Parts 43 and 45 of the CFTC’s regulations and associated provisions applicable to designated contract markets (DCMs) and DCOs. The CFTC staff also removed a prior condition prohibiting Railbird participants from clearing contracts through third-party clearing members, following amendments to Railbird’s DCM order permitting intermediation by futures commission merchants. The no-action position remains subject to several conditions, including that all Railbird contracts remain fully collateralized, Railbird publishes transaction data on its website promptly after execution, and the relevant entities maintain required records available for regulatory inspection. Railbird and Bitnomial must also continue complying with all other applicable Commodity Exchange Act and CFTC requirements outside the specified reporting and recordkeeping relief. The CFTC staff stated that the letter does not provide any legal conclusion regarding the legality or characteristics of Railbird contracts and that the relief may be modified, suspended or terminated at the discretion of the divisions.

On May 4, 2026, the Parliamentary Assembly of Bosnia and Herzegovina adopted the Law on Restricting Asset Disposal for the Purpose of Preventing Terrorism, Financing of Terrorism and Financing of Weapons of Mass Destruction. The law establishes a legal framework for restricting the disposal and management of assets with the objective of preventing terrorism, countering the financing of terrorism, and preventing the financing of weapons of mass destruction proliferation. Firms must adopt internal policies, controls and procedures for the implementation of targeted financial sanctions and shall regularly implement, review and update them in accordance with the nature, size and level of risk of their business and the sector in which they operate. The internal control system should at least include: Identification and assessment of the risk of breach of measures. Definition of the responsibilities of staff and the management structure. Procedures for checking data on parties and transactions for the purpose of detecting matches with lists. A reporting and record-keeping system. This law shall enter into force on the eighth day following its publication in the official gazette.

On May 2, 2026, the National Bank of Ukraine (NBU) clarified certain requirements in relation to bank lending that will contribute to further credit expansion, through amendments to the Regulation on Determining the Amount of Credit Risk by Banks of Ukraine for Active Banking Operations and the Resolution of the Board of the NBU No.13 dated February 3, 2026 . Key amendments include: Easing the conditions for terminating the recognition of default by a debtor (an individual with restructured debt). Reducing the values of the probability of default coefficients of debtors (individuals with mortgage loans). The right of banks to apply lower than average counterparty default probability ratios for irrevocable financial obligations based on internal bank loan assessment provisions by the NBU. The amendments come into force on May 2, 2026.

On May 2, 2026, President Volodymyr Zelenskyy signed a decree implementing sanctions against five individuals whose actions threaten Ukraine's national interests, security, sovereignty, and territorial integrity. The decision was made by the National Security and Defence Council of Ukraine. The sanctioned individuals include Ukrainian lawyer Andrii Bohdan; Ukrainian businessman Bohdan Pukish, described as an associate and partner of previously sanctioned Viktor Medvedchuk; Russian businessman Alan Kiriukhin, identified as a key manager of the sanctioned A7A5 payment system used to circumvent sanctions; and Stanislav Pozdniakov and Mikhail Mamiashvili, described as functionaries and propagandists of Russian Olympic sport. The restrictive measures imposed include deprivation of Ukrainian state awards, asset freezes, suspension of trade operations, prevention of capital withdrawal from Ukraine, suspension or revocation of licenses and permits, and a ban on participation in privatisation and rental of state property. The sanctions are imposed for a 10-year period, with the exception of deprivation of Ukrainian state awards, which is applied indefinitely.

On May 1, 2026, the US Office of the Comptroller of the Currency (OCC), US Federal Deposit Insurance Corporation (FDIC) and US Federal Reserve Board (FRB) issued their annual host state loan-to-deposit (LTD) ratios , replacing those issued in May 2025. Together, these regulators are informing national banks, federal savings associations and federal branches and agencies how the LTD ratios determine compliance with Section 109 of the Riegle-Neal Interstate Banking and Branching Efficiency Act (IBBEA) , which prohibits the use of interstate branches primarily for deposit production. Specifically, by law, a bank is generally prohibited from establishing or acquiring branches outside of its home state primarily for the purpose of acquiring additional deposits. This prohibition seeks to ensure that interstate bank branches will not take deposits from a community without the bank also reasonably helping to meet the credit needs of that community. The LTD ratios, based on data as of June 2025, exclude banks designated for Community Reinvestment Act (CRA) purposes as wholesale, limited purpose or special purpose banks. Each ratio compares the total loans in a state to total deposits in the state for all banks that are legally operating in that state.

On May 1, 2026, the US Office of Foreign Assets Control (OFAC) issued a series of new Iran-related designations via its Specially Designated Nationals (SDN) list, as well as issuing Iran-related General License W , which authorizes the wind down of transactions involving certain newly designated individuals and entities. The designations and related general license target individuals and entities involved in Iran's shadow banking networks as part of OFAC's "Economic Fury" initiative. Additionally, OFAC published a new frequently asked questions document ( FAQ 1250 ) and an alert on sanctions risks surrounding Iranian demands for passage through the Strait of Hormuz. These action were taken pursuant to Executive Order 13902 , targeting Iran's financial sector, and National Security Presidential Memorandum 2 (NSPM 2), which undergirds the US Department of the Treasury’s continued campaign of maximum economic pressure against Iran’s shadow banking networks and sanctions evasion.

On May 1, 2026, the extended ban on gambling on credit entered into force in Sweden, stipulated in Section 8, Chapter 14 of the Gambling Act . The ban aims to prevent debt accumulation among gambling consumers by prohibiting licensed operators and gambling agents from permitting or facilitating the financing of gambling with credit. The expanded credit ban applies to all licensed gambling forms regardless of distribution method. Licensed operators and gambling agents must not offer or provide credit for gambling stakes, nor facilitate third-party credit provision—including through links to lenders or loan brokers on their websites. The ban covers all types of credit, including credit cards, bank loans, invoicing arrangements, and loans from acquaintances. Licensed operators and gambling agents must implement appropriate measures to prevent credit-financed gambling. For land-based gambling, operators must block credit cards at payment terminals and display accessible information about the prohibition. For online gambling, operators must block credit cards as a payment option, prevent links to lenders or loan brokers, and ensure e-wallet payments do not utilise credit. Gambling agents selling in physical locations must train staff to refuse transactions when credit payment is apparent. The ban does not target consumers; operators bear responsibility for preventing credit-financed gambling. Consumers face no sanctions from the Swedish Gambling Authority for gambling on credit, though doing so carries increased risks of problem gambling and over-indebtedness. The authority may grant exemptions for public-benefit lotteries under specific conditions, provided total credit does not exceed 1/40 of the price base amount, which is equal to SEK1,480 in 2026.

On March 2026, the Massachusetts Gaming Commission issued a notice of public hearing to gather comments on proposed regulatory amendments under Massachusetts General Law Chapter 23K. The Commission is amending two regulations concerning responsible gaming provisions. The first amendment modifies 205 CMR 133.02 (Placement on the Self-Exclusion List) to replace references to "GameSense" advisors with "player health" advisors as designated agents authorised to administer the Commission's responsible gaming programme. The second amendment updates 205 CMR 147.03 (Notice and Patron Access) to remove reference to the "Game Sense" area within casinos and replace it with reference to a "player health resource and information center." These changes reflect the Commission's evolving approach to player protection and responsible gaming terminology. The public hearing will be conducted remotely via conference call on Tuesday, April 21, 2026, at 9:30 AM Eastern Standard Time. The conference call number is 1-646-741-5292 with participant code 111 714 1207. Interested parties may submit written comments via email to Jenna.Hentoff@massgaming.gov with "Regulation Comment" in the subject line. Alternatively, individuals wishing to speak during the hearing should email the same address to request the virtual hearing link. Written comments must be received by 5:00 PM EST on April 20, 2026. Draft regulations are available on the Commission's website at www.massgaming.com under the 'Regulations and Compliance' section. REFERENCES: Massachusetts Gaming Commission Notice of Public Hearing, March 2026

The State Bank of Vietnam (SBV) has launched a public consultation on a draft circular establishing limits and safety ratios for banking operations conducted by banks and foreign bank branches operating in Vietnam. The draft circular prescribes: Liquidity and funding ratios mandating the adoption of a liquidity coverage ratio (LCR) and a net stable funding ratio (NSFR) , establishing a roadmap for minimum LCR and NSFR compliance from 70 percent and 90 percent respectively in 2028 to 100 percent by 2031, while maintaining the loan-to-deposit ratio (CDR) at a maximum of 85 percent. Credit limits and leverage stipulating a minimum leverage ratio (LEV) of 3 percent, capping the total outstanding credit extended for investing and trading in corporate bonds or stocks at 5 percent of the charter or allocated capital, and setting limits on capital contribution and share purchasing. High-quality liquid assets (HQLA) and cash flow management defining HQLA into level 1, level 2A, and level 2B categories, detailing the calculation of expected cash outflows (incorporating run-off rates for retail and wholesale deposits, including operational deposits) and expected cash inflows (utilizing inflow rates). Internal regulations and risk management requiring banks to establish internal regulations on credit granting, asset quality assessment, and liquidity risk management, encompassing stress testing, intraday liquidity management, and collateral position management, while mandating semi-annual public disclosure of liquidity risk management policies and ratios. Government bond limits permitting banks to purchase, hold, or invest in government bonds and government-guaranteed bonds up to a maximum of 30 percent of the average total liabilities of the preceding month. Feedback may be submitted via post or by email to csatnh@sbv.gov.vn by June 1, 2026.

The Reserve Bank of India (RBI) has issued the Reserve Bank of India (Commercial Banks – Responsible Business Conduct) Amendment Directions, 2026,  establishing protocols for banking services during declared calamities. The directions prescribe: Temporary branch operations and alternative services stipulating that a bank may operate calamity-affected branches from temporary premises under advice to the concerned regional office of the Reserve Bank of India, requiring specific approval to continue beyond 30 days, and mandating arrangements to render banking services through satellite offices, extension counters, or mobile banking facilities. ATM restoration and cash requirements requiring a bank to take immediate action for the restoration of ATM services at the earliest and to provide alternative arrangements to address the immediate cash requirements of the affected areas during this period. Account opening for displaced persons permitting banks to open small accounts, as stipulated in the Reserve Bank of India (commercial banks– know your customer) directions, 2025, for displaced or adversely affected persons who may not have access to their identification and personal records. Fee waivers and relief measures allowing a bank, at its discretion, to provide relief measures such as the waiver or reduction of various fees and charges for customers in declared calamity areas for a period not exceeding one year. The amendments will come into force with effect from July 1, 2026.

The Reserve Bank of India (RBI) issued the Reserve Bank of India (Commercial Banks – Income Recognition, Asset Classification and Provisioning) Amendment Directions, 2026, modifying The directions prescribe: Asset classification norms stipulating that borrower accounts classified as standard may be retained as such upon the implementation of a resolution plan in adherence to chapter VI-A, mandating that accounts slipping into non-performing asset (NPA) status between the calamity occurrence and plan implementation be upgraded to standard, and ensuring that accounts previously restructured requiring subsequent restructuring under chapter VI-A continue to be classified as standard. Additional specific provisioning requiring a bank to make an additional specific provision of five percent of the outstanding debt for borrowers with an implemented chapter VI-A resolution plan, mandating another five percent for each instance of repeated restructuring subject to a 100 percent ceiling, and allowing these provisions to be written back upon the borrower paying at least 20 percent of the outstanding debt without slipping into NPA status or requiring further restructuring, or after one year for strictly non-fund-based facilities or cash credit and overdrafts provided there is no default. Interest income recognition prescribing that interest income recognition for borrower accounts with a chapter VI-A resolution plan shall be on an accrual basis, while stipulating that interest income for accounts undergoing repeated restructuring must be recognized on a cash basis. The amendments will come into force with effect from July 1, 2026.

On April 29, 2026, the Reserve Bank of India (RBI) issued amendment directions to the Reserve Bank of India (Non-Banking Financial Companies – Registration, Exemptions and Framework for Scale Based Regulation) Directions, 2025. The amendments introduce a new regulatory classification system for non-banking financial companies (NBFCs) and establish exemption provisions for specific NBFC categories. The amendments create two NBFC classifications: Type I NBFCs, defined as NBFCs not availing public funds and not having customer interface, and Type II NBFCs, which are all other registered NBFCs. NBFCs not availing public funds and not having customer interface with asset sizes below ₹1,000 crore are exempted from registration requirements under sections 45IA and 45IC of the Reserve Bank of India Act, 1934, provided they meet specified conditions. These conditions include operating without public funds and customer interface as a conscious long-term business model, passing annual board resolutions confirming this commitment, and disclosing their status as "Unregistered Type I NBFC" in financial statement notes. Existing NBFCs meeting exemption criteria may apply for deregistration within six months, by December 31, 2026, through the PRAVAAH portal. Applications must include audited financials for three years, statutory auditor certificates, board resolutions, and undertakings regarding disclosure obligations. NBFCs with asset sizes of ₹1,000 crore or above must apply for Type I NBFC registration. The amendments also clarify that exemptions apply only to sections 45IA and 45IC; exempted NBFCs remain subject to other provisions of Chapter IIIB of the RBI Act and remain subject to RBI supervisory action. Corresponding amendments have been made to thirteen related NBFC directions covering prudential norms, credit facilities, risk management, and financial statement presentation. The amendment directions come into force on July 1, 2026.

On May 1, 2026, the PlayCity Agency (the state authority responsible for regulating gambling and lotteries in Ukraine) issued Decision No. 164-Р imposing a fine of UAH432,350 (€8,383) on LLC "Slots U.A." for violations of Ukrainian gambling legislation. The betting operator had failed to provide information and documents at the request of the regulatory authority as stipulated in Article 15(1)(26) of the Gambling Law . The decision may be challenged within three months from the date it becomes binding. This enforcement action demonstrates the regulator's ongoing monitoring and compliance activities within the Ukrainian gambling market.

On 30 April 2026, the Australian Prudential Regulatory Authority (APRA) published a letter to industry calling for a significant step-change in how banks, insurers and superannuation trustees manage artificial intelligence related risks. The letter follows a targeted supervisory review APRA conducted across all its regulated industries in late 2025 to examine how AI was being deployed and governed. APRA identified that governance, risk management, assurance and operational resilience practices are not keeping pace with the scale, speed and complexity of AI adoption. Key findings include: AI use is accelerating across all APRA-regulated industries, with entities moving from experimentation to operationally embedded and customer-facing applications; however, boards often lack the technical literacy required to provide effective oversight of AI-related risks. There is heightened concentration risk, with some entities heavily dependent on single AI providers for multiple use cases and gaps in contingency planning. AI functionality embedded within broader software platforms reduces transparency over model training, updates and constraints, limiting entities' ability to assess and manage risks. Existing change and assurance management approaches are often fragmented and may not provide sufficient assurance for AI systems. AI models could enhance vulnerability discovery by malicious actors, further increasing the probability, speed and scale of cyber attacks. While APRA is not proposing additional requirements at this stage, it expects entities to demonstrate substantial improvement in alignment with existing prudential standards covering information security, operational risk management, governance and data risk. AI models could enhance vulnerability discovery by malicious actors, further increasing the probability, speed and scale of cyber attacks. While APRA is not proposing additional requirements at this stage, it expects entities to demonstrate substantial improvement in alignment with existing prudential standards covering information security, operational risk management, governance and data risk.

On April 30, 2026, the Malta Financial Services Authority (MFSA) issued a circular detailing amendments to the Investment Services Rulebooks to implement Directive (EU) 2024/927 The amendments address regulatory requirements established under the directive, which governs investment services and activities within the European Union. The amendments made to the Investment Services Rulebook include: The Investment Services Rules for Fund Managers Part BII: Standard Licence Conditions applicable to Investment Services Licence Holders which qualify as UCITS ManCos covering: Ancillary services. Enhanced dual control requirements Outsourcing. Ancillary services. Enhanced dual control requirements Outsourcing. The Investment Services Rules for Retail CIS: Part BII – Malta-based Retail UCITS Collective Investment Schemes covering: Liquidity management tools. Enhanced dual control requirements. Delegation reporting. Prior notification requirements. Outsourcing. Disclosure and reporting. Liquidity management tools. Enhanced dual control requirements. Delegation reporting. Prior notification requirements. Outsourcing. Disclosure and reporting. The Investment Services Rules for AIFs Part B Appendix 4 – Contents of the Offering Document Investment Services Rules for AIFMs Part B Appendix 13 – Transparency Requirements Regulated firms and investment service providers should review the amended rulebooks to ensure full compliance with the updated requirements. The revised rulebooks enter into force on May 1, 2026, the day after the circular is published.

On 30 April 2026, Belgium's Data Protection Authority (Autorité de protection des données) issued a substantive decision (96/2026) regarding a complaint about the dual filing of a customer as a non-payer. The case concerned a Belgian bank that transmitted personal data to the National Bank of Belgium (Banque Nationale de Belgique) for registration in the Unregistered Records (Enregistrements non régis) of the Personal Credit Register (Centrale des crédits aux particuliers), in addition to existing registration in the Business Credit Register (Centrale des crédits aux entreprises). The complainant, a self-employed individual, defaulted on two investment loans from February and March 2020 respectively. The bank subsequently filed the customer in both registers without providing explicit prior notification of the dual registration possibility. Additionally, the bank incorrectly classified one loan as an "instalment loan" (prêt à tempérament) in the Unregistered Records when it was actually a "term loan" (prêt à terme), as correctly recorded in the Business Credit Register. The Authority found the bank violated the transparency principle under Articles 5.1(a), 12.1, and 13 of the General Data Protection Regulation (GDPR) by failing to inform the customer sufficiently clearly about the possibility of registration in the Unregistered Records, making the treatment reasonably unforeseeable. The Authority also found a breach of the accuracy principle under Article 5.1(d) of the GDPR due to the incorrect loan classification. The Authority issued reprimands for both violations. The complaints regarding purpose limitation and lawfulness were dismissed on technical grounds, as the dual registration constituted part of the original data collection purpose rather than a separate secondary use.

On May 1, 2026, the National Bank of Ukraine (NBU) adopted the Resolution on Amendments to the Terms of Reference for the Assessment of the Stability of Banks and the Banking System of Ukraine in 2026. During the stress test, a bank's performance will be assessed over a three-year period under baseline and adverse scenarios. The stress test assumes the realisation of the main risks inherent in banking activities: Credit risk due to loan defaults. Interest rate risk due to the limited ability of banks to respond with lending rates to a rapid increase in the cost of liabilities and a decrease in the interest margin. Currency risk from the revaluation of banks' assets and liabilities, as well as indirectly through credit and interest rate risks. Operational risk due to additional losses in the first year of an adverse scenario. If the required capital adequacy levels of a bank determined based on the results of the sustainability assessment are higher than the regulatory values, the banks concerned will be required to draw up a capitalisation or restructuring programme. The stress testing approach was established through this resolution, which entered into force on May 1, 2026 and remains in force until December 31, 2026.

On May 1, 2026, the National Bank of Ukraine (NBU) adopted the Resolution on Amendments to Certain Regulatory Acts of the NBU, applicable to banks. Acoording to the resolutions, banks located in Ukraine shall: Develop or amend internal bank regulations and documents concerning the determination of credit risk for active banking operations and the management of non-performing assets. Calculate the amount of credit risk for active banking operations from the reporting dates of May 1, 2026, October 1, 2026, November 1, 2026 and January 1, 2027. Manage distressed assets from the reporting dates of October 1, 2026 and November 1, 2026. This resolution shall enter into force on the day following its official publication.

On April 30, 2026, the Icelandic government published Regulation 420/2026 concerning markets for virtual assets in the official gazette. The regulation incorporates two delegated EU regulations into the Icelandic legal framework. The first, Commission Delegated Regulation (EU) 2024/1506 , establishes detailed criteria for classifying asset-referenced tokens and e-money tokens as significant. The second, Commission Delegated Regulation (EU) 2024/1507 , specifies criteria and factors that the European Securities and Markets Authority (ESMA), the European Banking Authority (EBA) and competent national authorities must consider when exercising intervention powers. The regulation enters into force immediately.

On April 30, 2026, the Ontario Securities Commission (OSC) published for a 90‑day comment period proposed amendments to OSC Rule 13‑502 Fees and OSC Rule 13‑503 (Commodity Futures Act) Fees . According to the OSC's announcement , the proposals aim to address a funding gap caused by over a decade without a general fee increase, rising regulatory complexity and inflationary pressures. Small issuers and registrant firms would see fee reductions, while the largest market participants and crypto‑asset trading platforms (CTPs) would pay more. The OSC's key proposed amendments include: Issuer and registrant fee consolidation. Consolidates the bottom two participation fee tiers for issuers and registrant firms, which is estimated to result in 57 percent% of these market participants paying the lowest annual participation fee of CAD$750 or less. These amendments are estimated to lower annual fees by approximately CAD$200,000. Small registrant firm fee reductions. Reduces participation fee rates for smaller registrant firms whose Ontario-specified revenues are between CAD$500,000 and CAD$1m. These amendments are estimated to lower annual fees for those firms by CAD$300,000. New top‑tier fees for large participants. Introduces new tiers at the top level for issuers and registrant firms whose fees are disproportionately low in relation to the market growth experienced. These amendments are estimated to raise annual fees from the largest market participants by CAD$10m. Activity fee adjustments. Increases some existing activity and late fees, primarily to address inflationary pressures experienced since the OSC last updated rates. The OSC also proposes reducing certain capital raising filing fee rates by approximately 21 percent. These amendments are estimated to raise annual fees by CAD$2.4m, net of the proposed reductions. New crypto‑asset trading platform (CTP) fees. Introduces a new tier‑based participation fee model and activity fees for CTPs, adding an estimated CAD$1.2m in annual revenues. These new fees reflect the growing level of oversight in this expanding area to enhance investor protection and to support innovation. Other specified regulated entity fee increases. Increases participation fee rates and introduce new activity fees for other specified regulated entities, totalling CAD$1.1m. Annual CPI indexation. Introduces an annual Consumer Price Index (CPI) adjustment to issuer and registrant firm participation fee tier thresholds and fee rates. This amendment is expected to result in an average annual revenue increase of CAD$1.8m, beginning approximately one year after the effective date of the fee amendments (starting in April 2028). The OSC estimates the package would increase average annual revenues by about CAD$16m between April 2027 and March 2030. If finalised, the amendments are scheduled to take effect on April 5, 2027, and the 90‑day comment period closes on July 29, 2026 .

On April 30, 2026, the Canadian Centre for Cyber Security (Cyber Centre), together with its Australian, U.S., New Zealand and U.K. counterparts, released joint cybersecurity guidance on the careful adoption of agentic artificial intelligence (AI) services. Agentic AI systems use large language models (LLMs) to autonomously reason, plan, make decisions and take actions without human intervention. According to the Cyber Centre announcement , while these systems offer powerful automation benefits, their ability to act across interconnected tools and environments introduces significant security risks that organizations must address before deployment. Key findings and recommendations of the Cyber Centre include: Agentic AI poses distinct security risks beyond traditional AI or software: The guidance identifies privilege risks (over‑broad access, identity spoofing), behavioral risks (goal misalignment, deception, emergent capabilities), structural risks (orchestration failures, insecure third‑party components, rogue agents), and accountability risks (opaque decision‑making, hallucinations, lack of visibility). These risks can cascade across interconnected agents, making failures difficult to predict, observe and contain. Organizations should embed agentic AI controls within existing cybersecurity frameworks: The Cyber Centre advises treating AI security as part of established cyber practices (defense in depth, zero trust, continuous monitoring) rather than as a standalone discipline. Strict privilege management, authentication of all agent‑to‑agent and agent‑to‑service calls, and software bill of materials (SBOM) for third‑party components are essential. Practical best practices cover design, development, deployment and operation: Key recommendations include implementing layered security controls, progressive deployment with limited initial autonomy, human‑in‑the‑loop approval for high‑impact actions, continuous monitoring and logging of agent behavior, and use of red teaming and adversarial testing. Until security practices mature, organizations should restrict agentic AI to low‑risk, non‑sensitive tasks and never grant broad or unrestricted access to critical systems or sensitive data. The Cyber Centre strongly recommends that any organization considering agentic AI conduct threat modelling, establish clear governance policies, and ensure reversibility and risk containment before deployment. The full guidance is available on the Cyber Centre website.

On April 30, 2026, the Australian Prudential Regulatory Authority (APRA) finalised targeted amendments to prudential standard CPS 230 Operational Risk Management, prudential practice guide CPG 230, and the corresponding Material Service Provider Register template. The amendments introduce flexibility to third-party risk management, enabling regulated entities to identify, manage, and maintain critical operations through disruption, including risks arising from service providers. The key amendment is the inclusion of limited exemptions for non-traditional service providers (NTSPs), including central banks and financial market infrastructure (e.g. payment systems, clearing houses), where entities have little or no ability to negotiate contractual terms. Firms are still required required to: Identify and assess risks arising from these arrangements Implement appropriate controls (even if non-contractual) Monitor and manage ongoing exposure APRA also reinforces that CPS 230 is a principles-based, proportionate framework, meaning expectations can vary depending on the nature of the service provider and the criticality of the service. For NTSPs or exempt arrangements this means that due diligence and oversight may be less formal or indirect. However, firms must still demonstrate they have a clear understanding of the risk and appropriate governance and monitoring in place. These amendments take into effect on 1 July 2026.

On April 29, 2026, the Directorate General for the Regulation of Gambling (DGOJ) announced that Make Money Now SA, the company behind the content creators known as Zona Gemelos, has been fined €10,000 for promoting an unlicensed gambling operator in Spain. The fine is in accordance with the provisions of Law 13/2011 on gambling regulation and involves the removal of the illegal operator's advertising. The company's activity was identified as online gambling affiliate marketing, including links to unauthorised operators and commercial communications on social media platforms such as Instagram, Kick, X, and Discord.

The Reserve Bank of India (RBI) has issued the Reserve Bank of India (Non-Banking Financial Companies – Credit Risk Management) Second Amendment Directions, 2026. The amendments mandate that that credit assessments carried out by a non-banking financial company (NBFC)must suitably factor in the possible impact of calamities on borrowers who may be affected by such events. The amendment will come into force with effect from July 1, 2026.

On April 30, 2026, Denmark's Gaming Advertising Board issued a formal statement in case against Leanders Lukrative, operated by the sports media platform SpilXperten. The board determined that Leanders Lukrative constituted gambling marketing of gambling services in violation of Code of Conduct sections 8.2 and 8.4. The Board found that Benjamin Leander, as a former professional football referee with significant social media followers on platform X, qualifies as an "authority" with specialised insight into football under the Code of Conduct's definition. Section 8.2 prohibits direct gambling marketing using persons perceived by players as authorities with particular expertise in the game. Additionally, the Board concluded that the presentation and marketing of Leanders Lukrative was designed to improperly exploit vulnerabilities, credulity, inexperience, or lack of knowledge among vulnerable persons, in breach of section 8.4.

On 30 April 2026, the Account-to-Account Payments Roundtable released a public consultation on a draft vision for the future of account-to-account (A2A) payments in Australia. The Roundtable comprises the Australian Payments Network (AusPayNet), Australian Payments Plus (AP+), the Reserve Bank of Australia (RBA), and Commonwealth Treasury. 1. End-User Objectives: The vision is centered on five outcomes users expect when sending or receiving payments: Protections to keep money and information secure. Dependable processing at the expected time to the correct recipient. Affordable, competitive, and transparent pricing for core functions. Intuitive processes that integrate smoothly into business and personal life. Widely available with support for all users, including vulnerable groups. 2. System Characteristics: To meet these objectives, the payment system must demonstrate six key qualities: Robust risk-based safeguards and fraud intelligence sharing. Minimal service disruptions with clear contingency plans for critical flows like payroll and welfare. Support for everyday functions plus value-added innovations like in-app payments. Clear pathways for non-bank participants (fintechs/PSPs) to connect to infrastructure. Sustainable economic models for participants with transparent costs. Use of common rules, formats (like ISO 20022), and processes to ensure interoperability. 3. Scope and Future Directions: Marking domestic A2A payments including credit transfers, direct debits, and bulk payments as in scope; and debit cards (Visa/Mastercard/eftpos), cheques, physical cash, and the international leg of cross-border payments as out of scope. The system is also expected to eventually integrate with AI-driven payments, digital identity frameworks, and digital assets like stablecoins. The Roundtable is seeking feedback on this draft until 22 May. Following the consultation, a detailed industry roadmap will be developed in 2026 to define implementation milestones and transition plans for existing schemes like Bulk Electronic Clearing System and the New Payments Platform. Execution of this roadmap is expected to begin in 2027.

The Reserve Bank of India (RBI) has released the Reserve Bank of India (Commercial Banks – Resolution of Stressed Assets) Second Amendment Directions, 2026. The directions prescribe: Definitions and board policies including introducing definitions for the date of invocation and natural calamity, and mandating that a bank incorporate provisions for resolution into its board-approved policy, outlining objective principles for relief, verifiable parameters, and a delegation matrix for timely implementation. Committee roles and calamity scope stipulating that chapter VI-A governs resolutions for borrowers impacted by declared natural calamities or economic disturbances, and requiring the state level bankers' committee (SLBC), union territory level bankers' committee (UTLBC), or district consultative committee (DCC) to convene special meetings within 15 days of a declaration to assess severity, formulate criteria, and publicize decisions. Eligibility and implementation timelines requiring that eligible borrowers' accounts must be classified as standard and not in default for more than 30 days on the calamity occurrence date, and mandating that resolution must be invoked no later than 45 days and implemented within 135 days from the calamity declaration date, while allowing for suo moto invocation with a borrower opt-out and a potential 30-day extension for invocation in exceptional cases. Resolution plans and ancillary measures outlining that resolution plans may include rescheduling payments, converting accrued interest, or sanctioning additional finance based on viability assessments, and allowing banks to factor in insurance proceeds, government interest subventions, and alternative land ownership certificates for agricultural loans. Reporting requirements mandating that the SLBC or UTLBC convenor bank upload calamity declarations to the CIMS portal within 15 days, and requiring banks to upload data on relief measures half-yearly or submit a 'NIL' statement if no measures are extended. The amendments will come into force with effect from July 1, 2026.

The Reserve Bank of India (RBI) issued the Reserve Bank of India (Commercial Banks – Credit Risk Management) Third Amendment Directions, 2026. The amendments mandate that that credit assessments carried out by a bank must suitably factor in the possible impact of calamities on borrowers who may be affected by such events. The amendment will come into force with effect from July 1, 2026.

On April 30, 2026, the US Office of Foreign Assets Control (OFAC) imposed sanctions via an update to its Specially Designated Nationals (SDN) list on Joseph Kabange Kabila, former President of the Democratic Republic of the Congo (DRC), for his role in supporting the March 23 Movement (M23) and the Congo River Alliance (AFC). OFAC designated Kabila pursuant to Executive Order 13413 for materially assisting, sponsoring and providing financial, material and technological support to M23 and AFC. According to OFA C, the sanctions action supports the Washington Accords for Peace and Prosperity , signed by the DRC and Rwandan heads of state in 2025, which establishes commitments to regional economic integration and critical minerals supply chain transparency. As a result of his sanctioning, all property and interests in property of Kabila are blocked, and US individuals and entities are generally prohibited from conducting transactions with Kabila unless expressly authorized by OFAC.

On April 29, 2026, the Pennsylvania Gaming Control Board (PGCB) approved a consent agreement resulting in a $10,000 fine against Play'n GO New Jersey LLC, a licensed interactive gaming manufacturer. Play'n GO received the fine for failure to obtain PGCB approval for a change of control. A copy of the consent agreement can be found here .