Published

On September 21, 2026, the Gambling Commission suspended the combined remote operating licence of Targetlocal Ltd, which operates as Ken Howell's Sports Betting and runs kenhowells.com. The suspension follows Commission enquiries that revealed anti-money laundering (AML) failings by the operator. Targetlocal Ltd held an operating licence, which permitted it to offer casino, sports betting, and virtual event betting services online. The Commission is conducting a review of the licence under Section 116 of the Gambling Act 2005, and the suspension remains in effect until the Commission is satisfied the business demonstrates compliance with regulatory requirements. The suspension took effect immediately on September 21, 2026. The Commission has instructed Targetlocal Ltd to treat consumers fairly during the suspension period and keep them fully informed of any developments affecting their accounts or services. The suspension does not prevent consumers from accessing their accounts or withdrawing funds. Consumers can contact the business through its website for further information. The suspension applies only to Targetlocal Ltd's remote operations; its non-remote general betting standard licence remains unaffected. The enforcement action reflects the Commission's continued focus on AML compliance among licensed operators. Operators facing similar regulatory scrutiny should review their AML procedures and controls to ensure they meet the Commission's standards and avoid potential enforcement action.

On September 17, 2026, the Federal Deposit Insurance Corporation (FDIC) Board of Directors repealed its 2016 Board Statement on Development and Communication of Supervisory Recommendations . The 2016 Statement set out principles governing how the FDIC issued supervisory recommendations and has been replaced by a final rule creating a new Part 305 in the FDIC's regulations that, among other things, revises the FDIC's approach for supervisory communications. Under the final rule, the FDIC ended the use of matters requiring board attention and supervisory recommendations for examination findings, and will instead issue matters requiring attention. The 2016 Statement describes principles related to the FDIC’s issuance of “supervisory recommendations,” which has been superseded by the final rule. According to the news release, the FDIC continues to emphasize a balanced approach to supervision that comprehensively assesses financial risk to institutions and the Deposit Insurance Fund and conformance with banking and banking-related laws and regulations.

On September 18, 2026, the US Office of Foreign Assets Control (OFAC) issued a series of actions related to its Ethiopia- and Russia-related sanctions programs. Regarding its Ethiopia program, OFAC announced the expiration of the national emergency declared in Executive Order 14046 , which imposed sanctions related to the humanitarian and human rights crisis in Ethiopia. Following the expiration of this emergency declaration, OFAC removed from its Specially Designated Nationals (SDN) list all individuals and entities designated pursuant to the executive order whose property and interests had been blocked. The removals include the Eritrea-based People's Front for Democracy and Justice (PFDJ), four individuals and two commercial entities. OFAC also removed all frequently asked question (FAQ) documents pertaining to its Ethiopia sanctions program from its website. Concurrently, OFAC issued Russia-related General License 131J , which authorizes certain transactions surrounding the negotiation of and entry into contingent contracts for the sale of Lukoil International GmbH and related maintenance activities. OFAC simultaneously issued two amended Russia-related FAQ documents, FAQ 1224 and 1225 , to provide guidance on updated Russia sanctions compliance under the new general license.

On September 18, 2026, a coalition of state attorneys general announced a multi-state settlement with Credit Acceptance Corporation (CAC), resolving allegations that CAC originated numerous predatory car loans that consumers could not afford. In the settlement, the attorneys general allege that CAC assigned proprietary "scores" to loans predicting collection rates, but many consumers with low-scoring loans could not reasonably afford repayment, and many of these loans resulted in consumer defaults and vehicle repossession. Under the terms of the settlement, CAC was fined $694m in cash and debt relief to consumers nationwide.The settlement also requires CAC to make various reforms to its lending practices. CAC must provide "off ramps" for risky loans made from December 2025 onward, offering qualifying consumers 95 percent debt relief and prohibiting collection lawsuits against them for a five-year period beginning November 2, 2026. CAC must also prevent unlawful packing of Vehicle Service Contracts (VSC) and Guaranteed Asset Protection (GAP) products through enhanced pre-purchase disclosures, post-purchase notifications and easier cancellation processes. Additionally, CAC must provide pre-loan disclosures about default risks and vehicle value, as well as instituting a price cap of 109 percent of retail book value for certain consumers for seven years. The settlement was coordinated jointly by the attorney generals of Alabama, Alaska, Arizona, Arkansas, California, Colorado, Connecticut, Delaware, the District of Columbia, Florida, Georgia, Hawaii, Illinois, Indiana, Kentucky, Louisiana, Maine, Maryland, Michigan, Minnesota, Nebraska, Nevada, New Hampshire, New Jersey, New Mexico, North Carolina, North Dakota, Ohio, Oklahoma, Oregon, Pennsylvania, Rhode Island, South Carolina, South Dakota, Tennessee, Utah, Vermont, Virginia, Washington and Wisconsin.

On September 17, 2026, the Central Bank of Brazil (BCB) issued Normative Instruction No. 776 to postpone the implementation deadlines for two registration requirements in the BCB's Information System on Entities of Interest (Unicad). The postponement is due to the need for operational adjustments to the Unicad system. Key points of the Normative Instruction include: Banking as a Service (BaaS) registration: The deadline for service provider institutions to register BaaS service recipients in Unicad is extended from September 1, 2026 to October 1, 2026. Intra-conglomerate liquidity transfer registration: The deadline for institutions to register in Unicad the entities between which liquidity transfers within the same prudential conglomerate may occur without statutory, contractual, or regulatory restrictions is extended from October 1, 2026 to November 1, 2026. The Normative Instruction enters into force on the date of its publication.

On September 17, 2026, the Federal Deposit Insurance Corporation (FDIC) Board of Directors approved a notice of proposed rulemaking to modernize and reform its process for reviewing merger transactions under the Bank Merger Act (BMA). The proposed rule introduces several significant reforms designed to streamline the merger review process and reduce regulatory burden on financial institutions. Key changes include: Accounting for credit unions and centrally booked deposits in competitive effects analysis. Establishing a letter filing process with "deemed approval" for de minimis merger transactions. Tailoring merger filing requirements to reduce burden and processing times. Limiting and clarifying the FDIC's discretion to remove a filing from expedited processing. The FDIC will also reform its approach to evaluating the statutory factors under the BMA. Collectively, these reforms impose discipline around timelines and modernize the framework to reflect the current banking environment. The proposed rule aims to make the FDIC's review of merger transactions faster, more predictable, and appropriately tailored to reflect the type, size, and complexity of potential risks associated with merger transactions subject to FDIC approval. The comment period for the proposed rule closes 60 days after publication in the Federal Register. Interested parties, including banks, credit unions, and other stakeholders, should submit comments during this period to comments@fdic.gov. The FDIC will review all submissions before finalizing the rule.

On September 17, 2026, the US Securities and Exchange Commission (SEC) issued an order granting temporary, conditional exemptive relief under Section 36(a)(1) of the Securities Exchange Act of 1934 to facilitate the on-chain secondary trading of tokenized National Market System (NMS) stock. The order grants two forms of relief: an exemption for certain trading venues (Tokenized Securities Venues, TSVs) from the definition of "exchange" under Section 3(a)(1) of the Exchange Act; and an exemption for certain liquidity providers (Covered Firms) from the definition of "dealer" under Section 3(a)(5) of the Exchange Act. The exemptions expire five years after publication. The anti-fraud and anti-manipulation provisions of the federal securities laws apply in full to all activities within the exempted venues. TSV exchange exemption: A TSV brings together buyers and sellers of tokenized NMS stock by operating one or more automated market maker liquidity pools (AMM Liquidity Pools) for permissioned participants, and setting access standards for those pools. The exemption is subject to conditions including: Limits on the number of symbols and volume traded. Verification that tokenized NMS stock provides holders with the same rights as traditional NMS stock of an equivalent class, including dividend and voting rights. Prior written notice and an opportunity to object by the issuer of the underlying NMS stock before a third-party tokenised security is made available for trading. Use of smart contracts that are auditable, public, and deployed on a public, permissionless distributed ledger. Concurrent trading halts with the primary listing exchange; and public disclosure of TSV operations and trading activities. A TSV must be a US person and comply with OFAC sanctions programs. Limits on the number of symbols and volume traded. Verification that tokenized NMS stock provides holders with the same rights as traditional NMS stock of an equivalent class, including dividend and voting rights. Prior written notice and an opportunity to object by the issuer of the underlying NMS stock before a third-party tokenised security is made available for trading. Use of smart contracts that are auditable, public, and deployed on a public, permissionless distributed ledger. Concurrent trading halts with the primary listing exchange; and public disclosure of TSV operations and trading activities. A TSV must be a US person and comply with OFAC sanctions programs. Dealer exemption for Covered Firms: Liquidity providers that supply tokenized NMS stock using proprietary capital in an AMM Liquidity Pool, and that may also engage in additional dealing indicia such as quoting pricing to customers or entering into committed capital agreements, are conditionally exempted from the dealer definition under Section 3(a)(5) of the Exchange Act. No synthetic securities: TSVs may only trade tokenized NMS stock tokenized by, or on behalf of, the issuer of the underlying NMS stock, or by an unaffiliated third party. Synthetic representations of NMS stock not conferring the same rights as the underlying security are not permitted. The exemptions are set to expire five years after publication. The order solicits public comment about possible modifications to the exemptive relief and potential next steps. The SEC invites public comment on the order, which will be published on SEC.gov and in the Federal Register.

On August 27, 2026, the Commission de Surveillance du Secteur Financier (CSSF) published Circular CSSF 26/915, amending seven existing circulars to extend Digital Operational Resilience Act (DORA) requirements to third-country branches (TCBs) operating in Luxembourg. The update follows confirmation from the European Commission in December 2025 that DORA applies to TCBs established in European Union countries if their head offices would qualify as DORA entities in their home jurisdictions. The circular clarifies that TCBs of undertakings with head offices in third countries that would qualify under Article 2(1)(a) to (i), (k) to (m), (p), (r) and (s) of DORA, which include credit institutions, payment institutions, e-money institutions, crypto-asset service providers and investment firms, are now considered financial entities subject to DORA requirements. The amendments modify Circulars CSSF 20/750 , 22/806 , 25/881 , 25/882 , 25/883 , 25/892 and 25/893 . Key changes include removing TCBs from the scope of Circular CSSF 20/750 on information and communication technology (ICT) and security risk management, and removing ICT outsourcing requirements from Circular CSSF 22/806 while retaining general outsourcing provisions. TCBs are now included in Circulars CSSF 25/882 on ICT third-party services, CSSF 25/892 on aggregated costs from major ICT incidents, and CSSF 25/893 on incident reporting. The circular also introduces an alternative communication channel for reporting major ICT-related incidents and cyber threats. If technical impossibility prevents entities from using the primary submission channel, they may notify the CSSF via email at ictrisksupervision@cssf.lu, provided they explain the reasons for using the alternative channel and comply with applicable time limits. The circular applies with immediate effect.

On September 17, 2026, the US Office of Foreign Assets Control (OFAC) designated BitBank, a digital assets exchange controlled by OFAC-designated Iranian financier Babak Zanjani, as part of the US Department of the Treasury's broader "Operation Economic Outcast" campaign, and pursuant to Executive Order 13902 . OFAC also designated BitBank's developer, Pishtaz Simorgh Electronic Trade Company, and three associates of Zanjani: Hossein Ali Zaker Hossein, Mohammad Mahdi Zaker Hossein and Seyed Adel Heidari. According to a news release , the designations target key components of Iran's digital assets-based sanctions evasion infrastructure. As a result of the new designations, all US-based property and interests of these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC.

On September 17, 2026, the Federal Deposit Insurance Corporation (FDIC) Board of Directors approved a notice of proposed rulemaking to amend the agency's regulations and promote parity between state banks and national banks. Under the proposed rule, when host State laws do not apply to a national bank, those laws would similarly not apply to an out-of-State State bank providing services in the host State with or without a branch. Specifically, the amendments would provide that, for purposes of section 24(j) of the Federal Deposit Insurance Act , the laws of a host State apply to any branch in the host State of, or any services provided in the host State by, an out-of-State State bank to the same extent such State laws apply to a branch in the host State of, or any services provided in the host State by, an out-of-State national bank. Additional key points of the proposed rule include: Whenever a host State's law is deemed inapplicable to an out-of-State State bank, the laws of the bank's chartering (home) State will govern its activities instead. The proposal clarifies that the laws in question include host State regulations concerning community reinvestment, consumer protection, fair lending, and the establishment of intrastate branches. The rulemaking is intended to resolve legal uncertainty and a competitive imbalance. The proposed rule explicitly does not affect the interest rates that State banks are permitted to charge on loans, which will continue to be governed by section 27 of the Federal Deposit Insurance Act . The comment period closes 60 days after publication in the Federal Register. Stakeholders, including state banks, national banks, state regulators, and other interested parties, should submit comments during this window to MediaRequests@fdic.gov . The FDIC will review all submissions before finalizing the rule.

On September 16, 2026, the U.S. Securities and Exchange Commission (SEC) proposed to rescind Rule 14a-8 under the Securities Exchange Act of 1934 , which governs shareholder proposals. The SEC said the rule exceeds the Commission's statutory authority and intrudes into matters of state law. The agency outlined policy reasons for the proposed rescission, noting that many justifications for adopting the rule have not been substantiated in practice or are less compelling today. The SEC identified unintended consequences, including federal preemption implications that may have discouraged states from developing their own laws governing shareholder proposals. Rescinding Rule 14a-8 would leave determinations about the role of shareholder proposals to state law and company governing documents. The proposals reflect two regulatory priorities: Ensuring the Commission does not improperly intrude into state corporate law when applying federal securities laws. Updating the Commission's rules to reflect developments in market practice and technology since their adoption or last amendment. The SEC also proposed amendments to Rule 14a-4(c) to provide companies with greater flexibility and shareholders with greater control regarding proposals for which a company may seek discretionary proxy voting authority. Additionally, the SEC proposed separate rule amendments to modernize the proxy solicitation process which aim to : a. Eliminate the requirement that companies deliver annual reports to security holders. b. Eliminate delivery deadlines when documents are incorporated by reference into proxy statements. c. Eliminate the requirement and ability to submit Notices of Exempt Solicitation, and shorten the minimum broker search period from 20 business days to five business days. The public comment period will remain open for 60 days following publication of the proposing releases in the Federal Register.

On September 15, 2026, the Tokenization Working Group (GTT) of Brazil's Securities Commission (CVM) submitted to the CVM's Board a draft resolution proposing the creation of the CVM distributed ledger technology (DLT) Pilot Program. The initiative will test the issuance, offering, distribution, trading, registration, custody, centralized deposit, and settlement of securities on DLT networks. The pilot program aims to evaluate the technical, operational, and legal viability of DLT in Brazil's securities market, assess interoperability between networks, and identify risks, vulnerabilities, and potential regulatory gaps. Experimental operations may include shares, debentures, receivables certificates, investment fund quotas, and other collective investment titles or contracts. The CVM will directly monitor tests through real-time access mechanisms to voluntarily selected networks. External GTT members representing authorized entities or self-regulatory organizations may manage test networks. A Steering Committee comprising CVM members of the GTT will coordinate the pilot program. Tests will run for 60 days, extendable by up to 30 days. Participants must submit conclusive reports to the Steering Committee, which will consolidate findings and submit a final evaluation to the CVM Board. The evaluation will address results, identified risks, and recommendations for regulatory or legal improvements.

On July 1, 2026, Costa Rica's General Tax Directorate issued Resolution MH-DGT-RES-0000-2026 regarding the use of informative declaration forms for intermediaries handling credit and debit card transactions. The reform modifies three key aspects of intermediary withholding reporting: It restricts intermediaries from declaring withholdings exceeding amounts reported by acquirers in their own declarations. When intermediaries report excess amounts, the tax authority will withhold distribution of reported withholdings until the discrepancy is corrected. The resolution expands the definition of "intermediaries" to include payment processors, electronic wallets, payment gateways, and analogous entities that process electronic payments but do not qualify as acquirers under value-added tax (IVA) law. I It establishes that intermediaries must register through the Unified Tax Registry's virtual office; those failing to register will be registered ex officio by the tax authority. The reform also permits intermediaries to request revision of withholding factors applied by acquirers when retention percentages systematically generate credits or result in improper withholdings, based on the tax regime or IVA rates applicable to their affiliated companies' operations. The resolution includes a three-month transition period from publication for the tax authority and obligated parties to implement necessary technological adjustments. During this period, intermediaries must continue submitting monthly informative declarations under existing procedures. Following this transition, the tax authority will announce the effective date for daily declaration submissions via notice on its institutional website. The resolution entered into force upon publication in the Official Gazette (La Gaceta). Intermediaries already identified by the tax authority will be registered ex officio upon the resolution's effective date.

On September 15, 2026, Peru's Banking and Insurance Superintendent (SBS) issued Resolution SBS N° 02271-2026 authorizing public consultation on a new regulatory framework governing operational incident reporting. The resolution consolidates two existing reporting requirements: The report of significant operational interruption events. The report of significant cybersecurity incidents into a single operational incidents report. The new framework establishes standardized guidelines for reporting operational incidents, requiring supervised entities to submit initial, intermediate, and final reports for incidents they experience. This consolidation aims to standardize information submitted to the Banking and Insurance Superintendent and streamline compliance obligations for financial institutions, insurance companies, and private pension fund administrators under its supervision. The regulatory change applies to all entities supervised by the SBS, including banks, microfinance institutions, insurance companies, and private pension fund administrators. The framework reflects the Superintendent's supervisory experience and addresses the need for comprehensive incident tracking across operational disruptions and cybersecurity threats. The public consultation period runs for 30 calendar days from September 16, 2026 (the day following publication in the Official Gazette). Interested parties may submit comments and observations through the Banking and Insurance Superintendent's digital platform .

On September 16, 2026, the US Office of Foreign Assets Control (OFAC) announced updates to its sanctions designations and issued new authorizations for Venezuela-related transactions. Specifically, OFAC removed three individuals from its Specially Designated Nationals (SDN) list, two of which being linked to its Russia-related sanctions program under Executive Order 14024 , and one of which being linked to its counter-narcotics sanctions program . Concurrently, OFAC issued Venezuela-related General License 5Z , which authorizes certain transactions related to the Petróleos de Venezuela SA (PdVSA) 2020 8.5 percent bond. The license permits specified transactions involving the Venezuelan state oil company's 2020 bond issuance, effective from November 5, 2026 onwards. Additionally, OFAC updated a Venezuela-related frequently asked question (FAQ) document, FAQ 595 , to provide clarification on the scope and application of the new license.

On September 14, 2026, the Financial Markets Commission (CMF) published the final version of regulations strengthening the consent management system for reporters of the Consolidated Debt Registry (REDEC), established through General Norm N°540. The regulation aims to enhance debtor protection, promote best practices among reporters, and facilitate CMF supervision. Key adjustments incorporated feedback addressing technological aspects, implementation timelines, and reporting requirements. Major provisions include: Implementation is phased to allow reporting entities adequate time to adapt. Consent preservation: Reporting entities must store digitalized consents using mechanisms that guarantee confidentiality, integrity, authenticity, fidelity, and long-term verifiability. This replaces the previously consulted requirement for a SHA-256 encrypted hash code, adopting instead a principles-based, technologically neutral approach to reduce implementation costs. Debtor notification: Reporting entities must notify debtors when consent is granted or revoked, including the date, time, channel, and internal consent code, improving transparency and traceability throughout the consent lifecycle. Digitalized consent and internal coding: A Technical Annex defines the required formats for digitalized consents and requires the assignment of an internal code for each consent for effective traceability throughout the duration of the reportable obligation. Exemption regime: Entities that, by virtue of their business model, choose not to access debtor information subject to consent are exempt from the associated consent management requirements. API framework: Three APIs are established to operationalize the interaction between reporting entities and the CMF: API 1 for querying REDEC debtor information (currently in production); API 2 for CMF requests for digitalized consents from reporting entities; and API 3 for reporting entities to transmit digitalized consents to the CMF. Revocation of third-party authorizations: Debtors may revoke authorizations granted to third parties before the expiry of the access period via the CMF's Know Your Debt platform. Implementation will be done in a gradual manner: The requirements to notify the debtor set forth in sections 7.1 and 7.4 of NCG No. 540 are effective one month after the publication of the regulation (October 14, 2026). The requirement regarding the use of the consent APIs specified in 7.2 of NCG No. 540 is effective as of the third month following the publication of the regulation (December 14, 2026). The submission of regulatory files RDC01 and RDC02 containing the amendments to Section III of the regulation will be required starting with the report that must be submitted with information for the third month following the publication of the regulation (December 14, 2026). The submission of regulatory files RDC30 and RDC31 containing the indicated amendments will be required starting with the report that must be submitted with information for the month following the publication of the regulation (October 2026). .

On September 11, 2026, the Central Bank of Chile (BCCh) issued Circular Letter No. 770 , addressed to banks, cooperatives, financial market infrastructure operators, asset management companies under Law No. 20,345, and third parties in the Real-Time Gross Settlement System (LBTR), unifying the operational instructions for the use of the Payment Portal System as a contingency mechanism for submitting Fund Transfer Instructions (ITFs) in Chilean pesos (CLP) and United States dollars (USD). Key points of the circular are: The Payment Portal may be used by LBTR Participants and Third Parties unable to submit ITFs via SWIFT Interact messaging due to a SWIFT network failure, who request activation of the Portal's contingency mechanism. Participants must notify the BCCh's Payments and Settlement Systems Department via email at Sistemas_Pagos@bcentral.cl , specifying the currency or currencies requested, within LBTR operating hours. Only authorized representatives holding an "Operator" profile may use the Portal. Participants may designate differentiated "Enterer" and "Authorizer" profiles using the annexed forms, submitted to the BCCh's Notary Public with a certificate of authority. ITFs may be entered individually or in bulk via CSV upload. Settled ITFs are final and irrevocable. ITFs with insufficient funds are queued and cannot be cancelled. ITFs remaining in queue at the daily cutoff are automatically rejected and deemed cancelled. Participants are solely responsible for preventing duplication of ITFs submitted via the Portal against those sent via SWIFT. A per-ITF fee applies as set out in the LBTR Operating Rules, and a monthly fee of CLP 15,000 per active authorized representative is charged for SoftToken security devices. The circular takes effect the day after its publication.

In September 2026, the Oregon Division of Financial Regulation (DFR) issued a proposed bulletin advising owners and operators of cryptocurrency automated teller machines (crypto ATMs) that they must use the Nationwide Multistate Licensing System (NMLS) to obtain a money transmitter license under Oregon Revised Statutes (ORS) Chapter 717, the Oregon Money Transmitter Act . The proposed bulletin reiterated that crypto ATM owners and operators must comply with Oregon's money transmission licensing requirements. ORS 717.205 prohibits a person from conducting a money transmission business without a license, and applications may be submitted through NMLS. The proposed bulletin provides that ORS 717.200(10) defines "money" to include a medium of exchange authorized by a government or one that represents value substituting for currency, which captures virtual currency. Money transmission includes receiving money for transmission and transmitting money. Because crypto ATMs allow consumers to use a credit or debit card to buy, sell, or transfer cryptocurrency for a fee, and to send cryptocurrency to another electronic wallet or party, they fall within these definitions. Since "business" is undefined in ORS Chapter 717, Oregon law applies its plain meaning, including "dealings or transactions especially of an economic nature." The proposed bulletin concluded that crypto ATM operators are engaged in a money transmission business because their activities are economic in nature since they are conducted for profit. Therefore, the proposed bulletin states a license is required regardless of whether the cryptocurrency is drawn from the operator's own inventory or from a third-party cryptocurrency exchange. If adopted, the bulletin takes effect upon publication.

On September 14, 2026, Brazil's Securities Commission (CVM) issued its Annual Circular 2026 through the Securities Regulation Department (SRE). The circular provides general guidance on procedures that issuers, offerers, and intermediaries must observe when conducting public offerings of securities. The annual circular serves as a key compliance instrument for market participants engaged in public securities offerings in Brazil. It establishes procedural requirements and best practices that issuers and intermediaries must follow to ensure compliance with CVM regulations and maintain orderly market operations. It consolidates all prior SRE annual circulars, with the exception of circulars specifically addressing coordinator registration and the SRE System for registration of public offerings. Key points of the circular are: Communication with the SRE and procedural rules: All documents submitted in ordinary registration proceedings must be filed via the SRE System.  Documents submitted via the SRE System by 11:59pm on a given day are treated as filed on that day. Offering timelines and disclosure obligations: Public offerings are divided into the "market offering period" (commencing with the market notice) and the "distribution period" (commencing with the announcement of the start of distribution). The market notice, start announcement, and closing announcement must each be filed in the SRE System promptly. Regulatory supervision fees: The supervision fee of 0.03% of the total offering amount (minimum R$809.16) is payable at the time of registration request. The fee applies to the total offering amount including additional and supplementary lots. For primary and secondary offerings, each party must pay separately. Restitution requests may only be filed after the offering has closed. Investor profile suitability: Offering coordinators must verify not only suitability under CVM rules but also any other restrictions applicable to the target investor class, and must ensure that investors accessed in the offering are eligible to acquire the securities being offered. Automatic registration: Offerings eligible for automatic registration do not require prior CVM analysis. Offerings to professional investors must remain in the market offering phase for at least three business days if a market notice is used, or in distribution for at least three business days if no market offering phase is adopted. Revocation of automatically registered offerings does not require prior SRE approval but must be grounded in a substantial, subsequent, and unforeseeable change in circumstances. Series re-openings: Automatic registration for series reopening offerings directed at the general public is available only for non-convertible debentures of registered operational issuers and securitization certificates backed by a single issuer's debt, subject to conditions including identical terms, same target public, prior provision in the original issuance instrument, and updated prospectus and summary sheet. Reserved analysis: Issuers may request that ordinary registration proceedings be kept confidential, provided they justify the need for confidentiality. Prospectus content: Specific guidance is provided on the preparation of preliminary and definitive prospectuses, covering cover pages, risk factors, timetables, capital composition, conflicts of interest, distribution contracts, and statistical information on receivables for corporate certificates. Advertising materials: Advertising materials must be consistent with the prospectus, use measured language, and observe transparency and equal access principles. Virtual roadshows and live events are subject to the same requirements as written materials. Fund offerings: Guidance is provided on the use of proceeds from fund offerings in conflict of interest situations, the role of portfolio administrators acting as distributors, pre-emptive rights in closed-ended fund offerings, and private placement of fund units. Debentures and securitization: Specific guidance covers incentivized and infrastructure debentures, corporate issuers structured as limited liability companies, CRI and CRA offerings, FIC-FIDCs, CRA backed by CDCA, and chronograms for multi-series offerings. This annual guidance is essential for market participants to understand current CVM expectations and any updates to procedures or requirements for the year ahead. Issuers, offerers, and intermediaries should review the circular in detail to ensure their offering processes align with CVM requirements. The circular remains available on the CVM website for reference and implementation by all relevant market participants.

On September 14, 2026, the US Office of Foreign Assets Control (OFAC) designated VTB Bank, a Russia-based financial institution, for facilitating Iranian sanctions evasion. The designation was made pursuant to Executive Order 13902 , which targets certain sectors of the Iranian economy, including Iran's financial sector. According to a news release , VTB Bank established correspondent banking relationships with sanctioned Iranian financial institutions and opened bank offices in Iran to formalize banking coordination with the Iranian regime and expand bilateral trade. Additionlly, the bank moved billions of frozen Iranian assets and created a settlement system for national currencies through correspondent accounts denominated in Iranian rials and Russian rubles. As a result of this new sanctions designation, all US-based property and interests of VTB Bank are blocked, and US individuals and entities are generally prohibited from engaging in transactions with it, unless expressly authorized by OFAC. Concurrently, OFAC announced the issuance of Venezuela-related General License 52C , which authorizes certain transactions involving Petróleos de Venezuela SA (PdVSA), as well as the issuance of an amended Venezuela-related frequently asked question document: FAQ 1245 .

On September 14, 2026, the U.S. Securities and Exchange Commission (SEC) published draft updates to its 2027 eXtensible Business Reporting Language (XBRL) taxonomies accepted in the Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system, as part of its annual taxonomy review process. The draft updates are set out in the Draft 2027 Release Notes on the SEC taxonomies page . The draft updates cover the following taxonomies: Currency. Document and Entity Information (DEI). Exchanges. Executive Compensation Disclosure. Special Purpose Acquisition Company. Variable Insurance Product. The SEC staff encourages filers, investors, analysts, software service providers, and other interested parties to participate in this public review to continue to improve the process for creating and using structured filings. Upon consideration of public feedback, the taxonomies will be subject to Commission approval. Technical feedback may be submitted to StructuredData@sec.gov by November 16, 2026.

On September 14, 2026, the US Securities and Exchange Commission (SEC) Division of Examinations published a Risk Alert setting out examination observations regarding investment advisers' compliance with the annual review requirement under Rule 206(4)-7 (the Compliance Rule) of the Investment Advisers Act of 1940 . The Compliance Rule requires SEC-registered investment advisers to adopt and implement written compliance policies and procedures and to review their adequacy and effectiveness at least annually. The Risk Alert identifies five recurring deficiency areas observed during recent examinations and is intended to encourage advisers to assess and strengthen their annual review processes. The observations were in the following areas: Timeliness of annual reviews: The Division observed advisers that conducted reviews at intervals exceeding 12 months, had gaps in annual review coverage for specific years, substituted compliance training or personnel attestations for the required review, or had previously received deficiency letters for the same failures without taking corrective action. Completeness of policies and procedures: The Division observed advisers whose compliance policies required annual reviews but lacked accompanying procedures specifying the testing methodology, evaluation criteria, documentation standards, or scope of topics to be covered, resulting in annual reviews that omitted risk areas expressly identified elsewhere in the adviser's compliance program. Consistency with written procedures: The Division observed advisers that conducted timely reviews but did not follow their own written procedures, including by failing to cover the required review period, using incorrect documentation, or assessing outdated versions of policies and procedures that had been superseded prior to the review period. Alignment with business practices: The Division observed advisers that failed to identify, during their annual reviews, misalignments between their compliance policies and their actual practices. Recurring examples included fee and expense billing practices deviating from policies and client disclosures; proxy voting policies inconsistent with actual practice; custody policies failing to identify all accounts subject to surprise examination; marketing and Form CRS filing procedures not updated to reflect regulatory changes. Documentation and corrective action: The Division observed advisers that generated documentation during annual reviews but did not retain it in their books and records as required by Rule 204-2(a)(17)(ii) , and advisers that identified corrective actions during annual reviews but did not implement them, including in instances where written review reports stated that corrective actions had already been taken. In sharing examination observations regarding advisers’ compliance with the annual review requirements, the Division encourages advisers to reflect upon their own practices, policies, and procedures, and to implement any appropriate modifications to their annual review processes.

On September 8, 2026, the French Financial Markets Authority (AMF) published an informative guide designed to help financial professionals improve the readability and clarity of key information documents (KIDs) for retail investors. The guide encourages adopting best practices for presenting information about packaged investment products. European regulations require financial professionals to provide investors with comprehensible information about investment product characteristics. Packaged investment product initiators must produce a KID for each product, formatted for easy reading, using legible font sizes and concise, accessible language that avoids financial jargon and terminology. The AMF's qualitative research panel of retail investors revealed persistent difficulties with KID readability, primarily due to information density and technical vocabulary. A 2025 study examining KID readability involving 50 equity fund investors found that the KID was perceived as unattractive in form, complex in substance, and unsuitable for novice savers. Based on the findings, the AMF's guide provides three concrete recommendations: Improve KID presentation. Restructure the "What is this product?" section. Adopt clear language principles. The guide includes simplified writing examples based on plain language principles. Implementation of these recommendations remains at the discretion of product initiators, provided they comply with applicable European frameworks.

On September 14, 2026, the Cyprus Securities and Exchange Commission (CySEC) issued a reminder to financial entities regarding their obligation to submit annual contribution documentation under Regulation (EU) 2022/2554 (DORA). Following an initial announcement issued on August 26, 2026, CySEC reminded financial entities that they must submit the required form with supporting documentation through the CySEC portal no later than September 15, 2026. The submission covers the annual subscription fees arising from DORA compliance obligations. Financial entities that have not yet submitted the form are urged to take the necessary steps before the deadline expires. Financial entities requiring clarification or assistance with the submission process are directed to contact CySEC via email at accounts@cysec.gov.cy.

On September 14, 2026, the Spanish National Securities Market Commission (CNMV) published the results of its review of anti-money laundering and countering the financing of terrorism (AML/CTF) reporting for 2025. The review examined confidential statements (BCFT1) submitted by broker-dealers and brokers (SAVs), investment management companies, and crypto-asset service providers (CASPs). The initiative formed part of the CNMV's 2026 Activity Plan. The CNMV assessed compliance with reporting obligations, the quality and consistency of submitted information, and entities' adherence to AML/CTF regulations. Overall, the CNMV deemed the reporting quality and information content adequate, though it identified areas for improvement. The review found instances of incorrect or contradictory data, alongside details suggesting potential AML/CTF compliance issues. The CNMV highlighted three key areas requiring attention: Regulated entities must maintain risk analyses assessing inherent risk, control measures, and residual risk; establish written policies and procedures with adequate human and technical resources; maintain an internal control body; and undergo annual external expert examinations. Entities must establish suitable transaction alerts based on transaction type, parties involved, and amount, with mechanisms to determine whether transactions warrant special review. The CNMV noted that many entities reported no alerts and few conducted special reviews or suspicious transaction reporting. Entities must develop annual training plans ensuring staff receive regular training on legal obligations and suspicious transaction detection. As a result of the review, the CNMV will adjust its reporting manual over the coming weeks.

On September 14, 2026, the Office of the Comptroller of the Currency (OCC), the Federal Reserve System (Board), and the Federal Deposit Insurance Corporation (FDIC) jointly issued an interim final rule implementing section 903 of the 21st Century ROAD to Housing Ac t. The rule raises the asset threshold for certain supervised institutions to qualify for an 18-month on-site examination cycle from $3bn to $6bn in total assets. The agencies also made conforming changes to regulations governing U.S. branches and agencies of foreign banks consistent with the International Banking Act of 1978 (IBA) . The interim final rule expands eligibility for the extended examination cycle to insured depository institutions (IDIs) with total assets under $6bn that meet additional criteria: They must be well capitalized. Have a composite condition rating of "outstanding" or "good" (for institutions with assets not exceeding $200mn) . Not be subject to formal enforcement proceedings. Have not undergone a change in control within the previous 12 months. The agencies estimate the rule will increase the number of eligible institutions by approximately 188 banks and savings associations, bringing the total to approximately 4,016 institutions eligible for the 18-month cycle. This includes approximately 19 additional U.S. branches and agencies of foreign banks. The agencies determined that extending the examination cycle by six months for these small, well-rated institutions with relatively simple risk profiles should not appreciably increase their risk of financial deterioration or failure. The agencies will continue off-site monitoring activities and retain authority to conduct more frequent examinations when necessary. The interim final rule is effective on September 14, 2026. Comments on the rule must be received by October 14, 2026. Comments can be submitted via Regulations.gov using Docket ID OCC-2026-0761, or through the Federal Reserve and FDIC websites.

On September 11, 2026, the US Office of the Comptroller of the Currency (OCC), US Federal Deposit Insurance Corporation (FDIC) and US Federal Reserve Board (FRB) issued a joint statement to provide clarity on their risk-based supervision of certain services provided by core providers to community banks. According to a news release , the joint statement is designed to address select aspects of how community banks engage with core providers, the extent to which the regulators will take these aspects into consideration when determining supervisory oversight and the regulators' enforcement authorities when a core provider engages in or causes unsafe or unsound practices. The joint statement outlines factors the regulators will consider when making supervisory allocation decisions for core providers, including: Transparency: The core provider's willingness to provide timely due diligence information, use and transparency of service level agreements, timely disclosure of operational issues and security incidents and clear billing practices. Contracts: Business practices and contract terms that make it difficult for community banks to manage relationships according to their needs, such as opaque pricing, extensive retroactive billing, unsupported de-conversion fees and excessive limitations on integrations with alternative providers. Technology: The core provider's technology investments and capabilities, including the frequency and severity of security incidents, management of end-of-life assets and demonstrated operational resilience. Additionally, the joint statement clarifies that the regulators may bring enforcement actions against core providers, noting that they may have a reasonable basis to classify certain core providers as “institution-affiliated parties” (IAPs) under the Federal Deposit Insurance Act (FDIA) due to their integral role in the business of banking.

On September 11, 2026, the US Office of the Comptroller of the Currency (OCC), US Federal Deposit Insurance Corporation (FDIC), US National Credit Union Administration (NCUA) and US Federal Reserve Board (FRB) jointly issued proposed guidance revising and replacing existing third-party risk management guidance for banking organizations. According to a news release , the guidance aims to help banking organizations better align their third-party risk management practices in relation to the reasonably assessed risk levels specific to each third-party relationship. The guidance would emphasize tailoring risk management practices to each banking organization's size, complexity and risk profile, as well as the nature of individual third-party relationships, prioritizing these risk-based approaches over process-driven strategies that treat all third-party relationships as inherently higher-risk. The guidance would not set forth enforceable standards or prescriptive requirements. Interested parties may submit comments on the guidance up to 60 days after its publication in the Federal Register at this link .

On September 10, 2026, the US Office of the Comptroller of the Currency (OCC), US Federal Deposit Insurance Corporation (FDIC) and US Federal Reserve Board (FRB) jointly published an interim final rule amending regulations governing eligibility for extended examination cycles for certain community banks. According to a news release , this expansion aims to reduce examination burden on well-performing smaller institutions while maintaining the regulators' supervisory flexibility. The rule implements provisions of the 21st Century ROAD to Housing Act and Section 7(c)(1)(C) of the International Banking Act , expanding access to 18-month on-site examination cycles for qualifying banks. Previously, only 1- and 2-rated national banks, federal savings associations and federal branches and agencies with less than $3bn in total assets qualified for the extended 18-month examination cycle. The new rule raises this threshold to $6bn in total assets, thereby broadening eligibility. To qualify for the 18-month cycle, banks must meet several criteria: Maintain a 1- or 2-rating. Be well capitalised. Not be subject to a formal enforcement proceeding or order from a federal regulator. Not have experienced a change of control within the preceding 12 months. The rule stipulates that the OCC, FDIC and FRB retain discretionary authority to maintain a 12-month examination schedule or adopt a more frequent schedule for any bank if deemed necessary. The rule takes effective immediately , with comments accepted for 30 days.

On September 10, 2026, the US Office of Foreign Assets Control (OFAC) announced coordinated sanctions actions targeting networks that support Kata'ib Hizballah (KH) and Lebanese Hizballah, designated terrorist organizations that operate as proxies for the Iranian regime. The actions form part of the US Department of the Treasury's broader "Operation Economic Outcast" campaign, which is designed to sever Iran's economic infrastructure and dismantle its illicit financial networks. OFAC's actions include the following: New sanctions designations. OFAC designated 14 individuals and 5 entities across Iraq, Lebanon, the United Arab Emirates (UAE) and Türkiye with connections to Iranian proxies. Enforcement action for sanctions program violations. OFAC announced a $1.4m settlement with an individual for providing management consulting services to an Iranian software company and receiving Iranian-origin dividends. Licensing policy statement. OFAC published a new statement of licensing policy establishing a presumption of denial for Iran-related specific licenses, except where required by law or in limited circumstances involving risks to life or environmental safety.

On September 10, 2026, the US Financial Crimes Enforcement Network (FinCEN) issued a whistleblower bulletin encouraging members of the public to report suspected violations of Iran-related sanctions programs and anti-money laundering (AML) laws. According to a news release , the bulletin is intended to support the US Department of the Treasury's broader "Operation Economic Outcast" campaign, which targets Iranian oil smuggling networks, sanctions evasion schemes and terrorist financing channels. The bulletin outlines FinCEN's whistleblower incentive program, which accepts submissions from both US and non-US whistleblowers regarding individuals or entities potentially violating the Bank Secrecy Act (BSA) or sanctions programs administered by the US Office of Foreign Assets Control (OFAC). In the bulletin, FinCEN identifies specific typologies for whistleblowers to be aware of, including the use of high-risk jurisdictions, such as Iraq, the United Arab Emirates (UAE), Türkiye and China; irregular shipping documentation; payments to digital asset exchanges potentially linked to Iran; and suspicious activity by exchange houses and money services businesses (MSBs). The bulletin also highlights specific illicit finance schemes involving Iran's terrorist proxies, including transactions with entities in high-risk jurisdictions, suspicious digital asset payments and transfers to jurisdictions inconsistent with stated business purposes. Whistleblowers who voluntarily provide information leading to successful enforcement actions resulting in monetary penalties exceeding $1m may receive awards of 10 to 30 percent of collected penalties.

On September 10, 2026, the Central Bank of Chile  issued Circular Letter N° 769 updating the required forms for reporting external representatives within the Open Market Operations System (SOMA). The circular applies to multiple financial institutions and market participants, including banks, pension fund administrators, unemployment insurance fund administrators, insurance companies, mutual fund administrators operating under Law 20.712, stock exchange brokers and securities agents  and cooperatives. The measure establishes standardized procedures for financial institutions to report and manage information concerning external representatives participating in SOMA operations. This administrative update ensures consistent reporting practices across the financial sector and enhances transparency in open market operations conducted by the Central Bank of Chile. The circular applies to all covered institutions and supersedes or modifies previous guidance on this matter. It will come into effect from October 1, 2026.  Financial institutions should review their internal procedures to ensure compliance with the new reporting requirements for external representatives operating within the SOMA framework.

On September 10, 2026, the Central Bank of Chile issued Circular Letter No. 768, establishing procedures for reporting information regarding external representatives within the Real-Time Gross Settlement System (Sistema LBTR). The circular letter applies to banks, cooperatives, financial market infrastructure administrators, and entities regulated under Law No. 20,345. It builds on the Central Bank's existing framework for the Sistema LBTR, which governs settlement and liquidity arrangements in Chile's financial system. Circular Letter No. 768 establishes standardised procedures for Sistema LBTR participants to report and maintain current information on external representatives authorised to act on their behalf within the system. This requirement ensures the Central Bank maintains accurate records of authorised signatories and representatives, supporting operational transparency and risk management across the settlement infrastructure. The procedures apply to all Sistema LBTR members and are categorised under the Central Bank's financial market infrastructure guidance framework. The circular letter will come in effect from October 1, 2026 and applies to all current and future Sistema LBTR participants. Financial institutions and administrators must ensure compliance with the external representative reporting procedures outlined in Circular Letter No. 768.

On September 10, 2026, the New York State Department of Financial Services (DFS) issued new guidance outlining expectations for DFS-regulated entities conducting risk assessments of their cybersecurity programs. According to the DFS , the guidance is intended to clarify requirements under the DFS's primary cybersecurity regulation, 23 New York Codes, Rules and Regulations (NYCRR) Part 500 , as well as to share best practices that regulated entities should consider implementing. The guidance emphasizes that risk assessments form the foundation of strong cybersecurity programs and outlines key elements of such assessments, including governance and oversight, methodology, scope and documentation. The guidance also identifies factors that regulated entities should consider when performing risk assessments: Material technology changes, such as system migrations or acquisitions. Third-party risk, including evaluating dependencies on cloud providers, managed service providers or software platforms. Emerging risk from adoption of artificial intelligence (AI) or other new technologies. Risk-informed controls to determine whether existing controls, policies, monitoring or risk acceptance decisions require strengthening. The guidance does not impose any new obligations on regulated entities.

On September 8, 2026, the Canadian Securities Administrators (CSA) published the Data Portability Project Report, summarizing findings from a two-phase initiative exploring how data portability can enhance investor control over personal data, particularly through electronic Know-Your-Client (KYC) processes. Key findings and recommendations from the report include: Phase 1: Regulatory uncertainty as a barrier: Stakeholders expressed significant concern about how existing securities laws apply to data portability, particularly regarding KYC delegation restrictions and "meaningful interaction" requirements under National Instrument 31-103 . Uncertainty about whether using data portability service providers would violate these rules has deterred adoption. Phase 2: Implementation models discussed: Stakeholders explored four potential models for data portability, evaluating factors such as competitiveness and flexibility. No clear consensus emerged on a preferred model, though participants emphasized the importance of security, consent management, and accountability regardless of the underlying architecture. The report notes that data portability could reduce friction in customer onboarding for investors switching providers, while suitability assessments would be informed by ported KYC data. Privacy, security, and consent management: Stakeholders emphasized that investor consent must be explicit, revocable, and easy to manage through tools like "consent dashboards." Quebec participants highlighted the need to align with the province's Law 25 requirements for clear, time-limited consent. Data minimization principles and strong cybersecurity measures were identified as critical priorities. Key learnings and recommendations: Technology to enable data portability already exists, but implementation challenges remain in standardization, integration with firm workflows, and regulatory compliance. The CSA will use the feedback gathered to inform future rulemaking, guidance, and policy development, and will continue to monitor developments in the data portability ecosystem. The report concludes that the CSA will continue to monitor federal developments, consider clarifying KYC obligations in a data portability context, and monitor industry standards development.

On September 9, 2026, the US Office of Foreign Assets Control (OFAC) sanctioned Xinbi Guarantee, a Chinese-language platform that, according to OFAC , is used extensively by cybercriminals as an illicit online marketplace used to support cyber scams, fraud and money laundering. OFAC also designated two entities that support Xinbi Guarantee’s core operations via the provision of digital currency and other financial services. As a result of the new designations, all US-based property and interests of these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC. Additionally, OFAC amended several frequently asked questions (FAQs) to supplement the new designations, as well as publishing two new license-related FAQs: FAQ 1269 and FAQ 1270 .

On September 8, 2026, the US Office of the Comptroller of the Currency (OCC), US Financial Crimes Enforcement Network (FinCEN), US Federal Reserve Board (FRB), US Federal Deposit Insurance Corporation (FDIC) and US National Credit Union Administration (NCUA) jointly issued frequently asked questions (FAQs) addressing the use of state-issued mobile driver's licenses and other government-issued verifiable digital credentials (VDCs) in compliance with Bank Secrecy Act (BSA) requirements. The guidance clarifies how national banks, federal savings associations and federal branches and agencies may use VDCs to satisfy the Customer Identification Program (CIP) rule under 31 Code of Federal Regulations (CFR) 1020.220 . It defines what constitutes a VDC, as well as explaining the application of the CIP rule to banks' use of such credentials. The guidance also amends previously issued FAQs to update terminology describing VDCs, reflecting evolving standards in digital identity verification. According to a news release , the guidance and its interagency approach reflects a coordinated effort across banking and financial crime regulators to establish consistent standards for digital credential acceptance.

On September 8, 2026, the US Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned 36 targets, pursuant to Executive Order 13902 , for supporting Iran's aviation sector. The action targets 27 airlines, as well as covert front companies, foreign intermediaries and trans-shipment routes that Iran uses to obtain US-origin aircraft and sensitive technology, according to the Treasury . As a result of the new sanctions designations, all US-based property and interests of these targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC. Additionally, OFAC implemented the following supplementary actions with regard to its Iran sanctions programs: Issuing General License 37 , which authorizes the wind-down of transactions involving certain blocked persons under its latest designations. Publishing a notice of suspension surrounding certain Iranian transactions and sanctions regulations general licenses. Issuing General License DD , which authorizes the wind-down of certain civil aviation-related and other transactions previously authorized under its Iran sanctions programs. Concurrently, the Treasury's Financial Crimes Enforcement Network (FinCEN) issued an alert requesting that financial institutions report procurement networks supporting Iran's aviation industry, as well as highlighting several key red flag indicators to help them detect, prevent and report potentially suspicious activity involving Iran’s efforts to procure aircraft and aircraft parts.

On September 8, 2026, Chile's Financial Market Commission (CMF) issued a modification to Normative Circular N°539, with the objective of reducing the regulatory reporting burden on supervised financial entities. The amendment eliminates the requirement for banks, payment card issuers, savings and credit cooperatives, and business support entities to submit semiannual reports to the CMF regarding fraud-related incidents covered under the Fraud Law (Law N°20.009). Under Article 11 of Law N°20.009, supervised entities must publish information on their websites detailing the number of users affected by cases of loss, theft, robbery, and fraud, including the amounts involved and the timeframes within which the entities responded to or fulfilled their obligations. Previously, Normative Circular N°539 required these entities to also submit these semiannual publications to the CMF for validation purposes. The CMF determined that it could conduct necessary validations directly from information published on entities' websites, making the submission requirement redundant. Consequently, the CMF eliminated this obligation, effective from the semiannual reporting period for the second half of 2026. This regulatory change aims to streamline compliance requirements and reduce administrative burden on supervised institutions while maintaining the CMF's oversight capacity through direct access to publicly available information.

On September 8, 2026, the U.S. Securities and Exchange Commission (SEC) Division of Corporation Finance expanded accommodations available for issuers that submit draft registration statements for nonpublic review to issuers of asset-backed securities (“ABS Issuers”) using Forms SF-1 and SF-3 According to the SEC, it will now review draft initial registration statements, and any revisions, submitted under the Securities Act on either Form SF-1 or Form SF-3 on a nonpublic basis so long as the ABS Issuer confirms in a cover letter to the nonpublic draft submission that it will publicly file its registration statement and nonpublic draft submissions at least 15 days prior to any road show or, in the absence of a road show, at least 15 days prior to the requested effective date of the registration statement. The SEC will continue to publicly release staff comment letters and responses to those letters on the Electronic Data Gathering, Analysis, and Retrieval (EDGAR) system no earlier than 20 business days following the effective date of a registration statement. The review is limited to the following registration statements (initial registrations): The initial registration statement of a depositor that has not previously filed a Securities Act registration statement on either Form SF-1 or Form SF-3. A new registration statement on Form SF-3 filed by a depositor who, at the time of filing the draft registration statement, does not have an effective registration statement. A new registration statement on Form SF-1 or Form SF-3 filed by a depositor registering an offering of ABS in an asset class for which it does not currently have an effective Securities Act registration statement. The SEC will also accept for nonpublic review any registration statement on Form SF-1 or Form SF-3 other than the Initial Registrations listed above, so long as the ABS Issuer submitting such draft registration statement confirms in its cover letter that it will file the registration statement and nonpublic draft submission such that they are publicly available on the EDGAR system at least two business days prior to any requested effective time and date. ABS issuers with questions about eligibility may contact the SEC at ABSDraftPolicy@sec.gov. The staff will monitor practices under these procedures and may modify, limit, or terminate them as needed.

On September 7, 2026, Armenia's State Revenue Committee (SRC) announced enhanced state oversight of unlicensed online gambling operations. The SRC said new regulations will take effect on February 8, 2027, following amendments to the Law on the Regulation of Gambling Activities and related legislation. The new regulations will revise existing mechanisms for blocking websites offering online games of chance and lotteries operated by unlicensed organisations. The SRC identified the need for strengthened enforcement due to the widespread proliferation of gambling services and advertising from foreign unlicensed operators across Armenia's digital domain, which has outpaced the effectiveness of current administrative tools. According to the SRC, foreign operators operate outside Armenia's legal framework, limiting the effectiveness of existing enforcement measures. The enhanced framework introduces technical blocking measures administered through telecommunications operators to restrict access to unlicensed gambling websites. It will also restrict the distribution of advertising for unlicensed gambling websites. The SRC emphasised that the measures do not restrict lawful gambling activities. Instead, they are intended to improve the effectiveness of the licensing system, protect the licensed gambling market and ensure equal competitive conditions by addressing risks associated with unlicensed gambling.

On September 4, 2026, the US Office of Foreign Assets Control (OFAC) issued Iran General License CC, which authorizes the wind down of transactions involving three Turkish-based entities—Golden Global Yatirim Bankasi Anonim Sirketi, Golden Global Varlik Kiralama Anonim Sirketi, and Golden Global Portfoy Yonetimi Anonim Sirketi—through September 19, 2026. The same three entities were also added to OFAC's Specially Designated Nationals (SDN) List under Executive Order 13902. The wind-down authorization applies to any entity in which these persons own, directly or indirectly, a 50 percent or greater interest, provided that any payment to a blocked person must be made into a blocked, interest-bearing account located in the United States. The designations block all US-based property of these targets and generally prohibit US individuals and entities from engaging in transactions with them, unless expressly authorized by OFAC.

On September 2026, the Florida Office of Financial Regulation (OFR) entered a Final Order approving a Stipulation and Consent Agreement with Gulf Management Systems, Inc., resolving compliance violations under Chapter 560, Florida Statutes identified during an examination of the money services business. Gulf Management Systems holds a money services business license in Florida and is subject to regulation under Chapter 560, Florida Statutes. During examination, the OFR identified three compliance failures. The company failed to timely report the closing or opening of bank accounts. It also failed to timely and accurately submit quarterly reports in the format and with the information specified by Chapter 560. Additionally, Gulf Management Systems did not implement an anti-money laundering (AML) and Bank Secrecy Act (BSA) policy and procedure. Gulf Management Systems was ordered to pay an administrative fine of $3,500. Under the settlement agreement, the money services business also agrees to cease and desist from future violations of Chapter 560, Florida Statutes, and comply with all applicable provisions.

On September 2, 2026, the Federal Deposit Insurance Corporation (FDIC), alongside the Board of Governors of the Federal Reserve System, the National Credit Union Administration, the Office of the Comptroller of the Currency, and the Financial Crimes Enforcement Network, issued a joint statement clarifying confidentiality requirements related to Suspicious Activity Reports (SARs) under the Bank Secrecy Act (BSA). The statement addresses how banks may communicate with customers regarding potentially fraudulent transactions, suspicious activity such as payment or check fraud, or account closures. The BSA prohibits disclosure of a SAR or any information that would reveal its existence, including to customers or persons who are the subject of the SAR. However, the joint statement clarifies that this prohibition does not prevent banks from communicating with customers or third parties about potentially fraudulent or suspicious transactions involving the customer's account, or notifying customers of the bank's intention to close an account for potentially fraudulent or suspicious activity—provided such communication does not reveal the existence of a SAR. The statement applies to all FDIC-insured financial institutions. It emphasizes that banks should evaluate customer communications on a case-by-case basis and implement precautions when discussing information that could inadvertently reveal the existence of a SAR. This guidance aims to balance regulatory confidentiality requirements with the operational need for banks to communicate transparently with customers about account activity and decisions affecting their accounts.

On September 1, 2026, the Texas Department of Banking (DOB) issued Supervisory Memorandum 1003, clarifying examination frequency requirements for state-chartered banks and their trust departments. The memorandum outlines the DOB's policy for on-site examination timing, generally aligning with federal examination frequency requirements while preserving the Commissioner's authority to examine any state bank as frequently as deemed necessary. Key provisions of the memorandum include: Examination frequency by asset size and condition: The frequency of examinations is determined by the bank's size, financial condition, and CAMELS ratings. Banks in strong financial condition may qualify for an 18-month examination cycle, while banks with higher risk profiles, lower ratings, or capital deficiencies are examined on a 12-month cycle or more frequently. Examination scope types: The Department utilizes four types of examination scopes: Full Scope (most comprehensive, results in a Report of Examination and CAMELS rating assignment), Visitation (narrowly scoped, results in a Letter of Findings), Interim Risk Examination and Assessment (IREAP) (risk-focused reviews that may result in CAMELS component changes), and Continuous Examination Program (used for larger institutions, generally $10b and greater, consisting of targeted reviews over a 12-month cycle). Exceptions to examination schedule: Shortened examination cycles may be imposed for institutions operating under certain circumstances, including change of control, component ratings of three or worse, or formal or informal enforcement actions. Extensions of up to six months may be granted for extenuating circumstances such as anticipated mergers, charter changes, or natural disasters, with approval required from the Deputy Commissioner and Commissioner. Questions about the memorandum may be directed to the Deputy Commissioner of Bank and Trust Supervision at 512-475-1300.

On September 3, 2026, the Central Bank of Brazil (BCB) approved an enhanced standard for the Report on Social, Environmental and Climate Risks and Opportunities (Relatório GRSAC), which regulated institutions must disclose. The updated framework expands transparency regarding how institutions identify, monitor and manage risks related to social, environmental and climate matters. The new GRSAC model incorporates standardized metrics and indicators alongside enhanced qualitative information already required. These additions enable greater comparability across institutions, fostering a safer and more reliable environment for managing such risks and supporting market discipline and financial stability. The disclosure requirements address physical and transition climate risks, social risks and environmental risks. The framework also standardises how institutions report voluntary targets and commitments related to these areas. The BCB developed the requirement based on international best practices recommended by the Basel Committee on Banking Supervision and conducted an extensive public consultation involving representative entities, regulated institutions, civil society organizations, researchers and citizens. Alignment with international practices enhances the attractiveness of responsible investments and reduces costs by expanding information availability for investors, clients, analysts and other market participants. The new report represents the second phase of the regulatory framework's enhancement process and forms part of the BC's strategic agenda. The new rules enter into force on January 1, 2027, with a gradual implementation schedule for information disclosure based on the size and profile of institutions.

On September 3, 2026, the Central Bank of Brazil (BCB) released version 7.4 of the Manual of Minimum Requirements for Pix User Experience, introducing significant improvements to transaction dispute resolution and security protections. The new requirements take effect on March 1, 2027, providing participating institutions time to update their applications. The update focuses on enhancing the Special Refund Mechanism (Mecanismo Especial de Devolução or MED), which has been available since October 1, 2025. The BC identified opportunities to improve the dispute journey based on nearly one year of operational experience. The revised process now presents fraud and scam scenarios in everyday language, allowing users to provide detailed context and attach supporting documents. These enhancements help both the victim's institution and the receiving institution conduct more thorough fraud analysis. The update also better guides users when reported situations fall outside MED eligibility—such as commercial disputes not involving fraud—directing them to appropriate support channels. The core MED rules remain unchanged, including the 80-day maximum window to request a refund and the 11-day deadline for institutions to notify users of dispute outcomes. Additional changes prohibit including advertising, promotional content, hyperlinks, or unrelated materials on Pix payment receipts, reducing fraud risks from malicious links. The manual also introduces requirements for saved contact functionality, requiring storage of the Pix key used in transactions and mandatory alerts when recipient identification changes. Automatic Pix payments now prominently display the payment purpose field alongside recipient identification. Enhanced standardization of user-facing messages across all journeys—including key initiation, QR code usage, and key management—ensures clearer, more informative communication, particularly regarding suspected fraud situations.

On September 3, 2026, the US Securities and Exchange Commission (SEC) issued a proposal to rescind its "pay-to-play" rule, which has prohibited investment advisers from providing compensated investment advisory services to government clients for two years following political contributions to certain elected officials or candidates. All other requirements of the Advisers Act and its associated rules, including prohibitions on fraud, fiduciary duty requirements, the compliance rule, and the code of ethics rule, would continue to apply. The SEC has determined that the political contribution rule, since its adoption in 2010, has led to significant unintended consequences, such as prohibitions by some advisers on political contributions at the state and local level. Advisers have indicated that the rule is operationally challenging to implement, and creates a de facto strict liability standard, which can lead to situations where small donations or “foot faults” potentially trigger substantial prohibitions and fines. Specifically, the proposal would rescind Advisers Act Rule 206(4)-5 and amend the Advisers Act recordkeeping rule to eliminate the corresponding provisions related to the political contribution rule. The public comment period will remain open for 60 days after the proposing release is published in the Federal Register.

On September 3, 2026, the US Office of Foreign Assets Control (OFAC) issued Cuba General License 4A. The license authorizes transactions involving blocked persons that are ordinarily incident to the official business of third-country diplomatic and consular missions in Cuba, as well as personal expenditures of their employees, grantees, and contractors. OFAC also added one individual and six entities to its Specially Designated Nationals (SDN) List under the Cuba sanctions program established by Executive Order 14404 and removed a Russia-related entity from the SDN List. The newly designated individual is Fidel Ernesto Castro Calis. The newly designated entities include Banco Exterior de Cuba, Comercial Cupet S.A., Empresa de Servicios Comandante Rene Ramos Latour (Nicarotec), Empresa Importadora de Abastecimiento para el Petroleo (Abapet), and Empresa Importadora y Abastecedora del Niquel (Cexni). Additionally, OFAC removed the Russia-related entity Dulac Capital Ltd. and its aliases from the SDN List. The designations block all US-based property of these targets and generally prohibit US individuals and entities from engaging in transactions with them, unless expressly authorized by OFAC.

On September 2, 2026, the Financial Crimes Enforcement Network (FinCEN) issued a Geographic Targeting Order (GTO) requiring money services businesses along the southwest border of the United States to report and retain records of currency transactions between $1,000 and $10,000. The GTO applies to money services businesses located in specified zip codes across Texas (Cameron, El Paso, Hidalgo, Maverick, and Webb counties) and New Mexico (Bernalillo, Dona Ana, and San Juan counties). According to FinCEN's press release , the reissued GTO aims to provide law enforcement with actionable data to combat the flow of drugs into the United States and associated money laundering activity, and to deny individuals and entities associated with drug trafficking organizations access to the U.S. financial system. Covered businesses must file Currency Transaction Reports (CTRs) with FinCEN within 30 days of each covered transaction and verify the identity of persons presenting such transactions, recording specific identifying information on the report. Covered businesses must also continue filing CTRs for transactions exceeding $10,000 and Suspicious Activity Reports where appropriate. Reports must be submitted electronically through the BSA E-Filing System . FinCEN encourages voluntary filing of Suspicious Activity Reports for transactions designed to evade the $1,000 reporting threshold. Covered businesses must retain all compliance records for five years from the order's expiration and make them available to FinCEN and other law enforcement agencies upon request. The order becomes effective September 3, 2026, and expires March 1, 2027. The compliance date for money services businesses not covered under FinCEN's previous GTO published March 10, 2026, is October 3, 2026. Covered businesses must transmit the order to officers, directors, employees, agents, and chief executives located in the covered geographic area. Noncompliance may result in civil or criminal penalties.