Published

On July 16, 2026, the US Office of the Comptroller of the Currency (OCC), US Federal Deposit Insurance Corporation (FDIC) and US Federal Reserve Board (FRB) jointly issued a policy statement describing enhanced security procedures surrounding the review of highly sensitive information in connection with examinations of supervised banks, such as reviewing materials on-site rather than transferring them onto agency systems. The policy statement discusses a coordinated approach to identifying highly sensitive data and documents, and discusses enhanced procedures for the review of such information to reduce cybersecurity risks while ensuring that the agencies have access to such information at all times during an examination. According to a news release , the agencies recognize the importance of keeping a bank’s highly sensitive information confidential and protecting it against disclosure to or from access by unauthorized persons as a result of cybersecurity vulnerabilities. The agencies have committed to notify affected banks of any potential or confirmed material data breach involving confidential supervisory information.

On June 16, 2026, the US Office of the Comptroller of the Currency (OCC) issued a cease and desist order against United Texas Bank for deficiencies in its Bank Secrecy Act (BSA) and anti-money laundering (AML) compliance program. United Texas Bank consented to the order as part of its conversion to a national bank supervised by the OCC. The bank had previously consented to an August 2024 order issued jointly by the Federal Reserve Bank of Dallas and the Texas Department of Banking.

On July 16 2026, the Dutch Gambling Authority (KSA) issued a warning to SCGO Limited, operating in the Netherlands as Vbet, for repeatedly offering prohibited betting markets. During enhanced supervision surrounding the FIFA World Cup football tournament, the authority identified that Vbet offered live betting on specific in-match events, including throw-ins, fouls, corner kicks, and offsides. The KSA prohibits betting on certain match events due to heightened risks of match manipulation. The warning follows the operator's failure to maintain compliance after the initial intervention. The Dutch Gambling Authority stated that further violations may result in enforcement action. The warning reflects intensified supervision during the World Cup period, during which the authority conducts comprehensive monitoring of licensed operators' betting offerings to ensure compliance with Dutch regulations.

On July 15, 2026, the New York State Department of Financial Services (DFS) issued proposed regulations that would establish a comprehensive regulatory framework for Buy Now Pay Later (BNPL) lenders. The new framework would requires BNPL lenders, defined as entities offering closed-end credit for consumer purchases of goods and services (excluding motor vehicles), to obtain licenses from the DFS unless they qualify as exempt organizations or banking entities. BNPL lenders would be required to apply within 45 days of an eventual effective date of the regulations, and would be deemed provisional licensees pending approval. The proposed regulations would also distinguish between interest-free and interest-bearing BNPL loans, each with separate supervisory permissions. Additionally, BNPL licensees would be required to maintain minimum capital, post corporate surety bonds and file unaudited quarterly financial statements within 45 days of quarter-end and audited annual statements within 90 days of fiscal year-end. Further provisions of the proposed regulations would require BNPL lenders to, among other things: Establish compliance officer positions and maintain detailed records of loans, pricing matrices and credit grades. Impose strict consumer protections, including mandatory pre-transaction and post-transaction disclosures substantially similar to DFS-provided model forms. Issue periodic statements must be provided within 30-day cycles. Prohibit charging late fees exceeding $8 under a safe harbor provision, or higher amounts without DFS approval demonstrating reasonable cost proportionality. Prohibit deceptive advertising, as well as requiring Spanish-language disclosures and customer service in Spanish and other languages used in advertisements. Establish data privacy protections and require affirmative consumer consent for any use, sale or sharing of covered data beyond loan origination, with consent effective for one year only. Retain consumers dispute rights, with unauthorized use liability capped at $50, and refund rights processed within three business days of credit statement receipt. Post licenses conspicuously on all platforms and websites and maintain advertising materials for seven years. Furthermore, the proposed regulations would amend the fee structure under Section 18-A of the New York State Banking Law , and would modify the "licensed financial services providers group" definition to include BNPL lenders, establishing BNPL loan origination and platform volume as the industry financial basis for fee distribution. Interested parties may submit comments on the proposed regulations until September 14, 2026 at this link .

On July 16, 2026, the New York State Department of Financial Services (DFS) executed a consent order with Swedbank and its New York branch, resolving an enforcement action stemming from the bank's failure to provide complete information in response to multiple regulatory requests concerning the Panama Papers scandal. The DFS initiated its investigation following the April 2016 leak of documents, which exposed connections between global financial institutions and offshore entities used for illicit purposes. Specifically, Swedbank failed to disclose information to the DFS on two occasions in 2016 and 2018 concerning its anti-money laundering and counter-terrorism financing (AML/CTF) prevention framework, as well as information disclosure practices during the period between 2007 and 2019. Under the consent order, Swedbank and its New York branch must pay a civil monetary penalty off $50m within ten days. The consent order also requires Swedbank's full cooperation with the DFS and prohibits it from claiming tax deductions related to the penalty payment.

On July 16, 2026, the US Securities and Exchange Commission (SEC) announced a proposed rule titled "Regulation E-Delivery", which would expand electronic delivery of required regulatory information across the securities industry. The proposed rule would allow issuers, broker-dealers, investment advisers and other market participants to deliver information electronically by default, rather than requiring affirmative consent from recipients before transitioning from paper delivery, while still preserving the ability to receive information in paper format upon request. The proposed rule would supersede the SEC's decades-old, guidance-based electronic delivery approach and cover a broad range of information, including prospectuses, fund shareholder reports, proxy statements, trade confirmations, Form CRS disclosures and Form ADV Part 2 brochures. According to the SEC, the proposed rule represents an important step toward modernizing the regulatory framework, with SEC Chairman Paul S. Atkins noting that "in an age of artificial intelligence and blockchain technology, a default to paper delivery should be a relic, not a standard". The SEC anticipates that electronic delivery would generate cost savings for issuers, market intermediaries and investors through reduced paper, printing and postage expenses. The proposed rule also aims to provide investors with more personalized, interactive, timely and efficient disclosure experiences, along with improved accessibility and information retention benefits. Interested parties may submit comments on the proposed rule until September 14, 2026 at this link .

On July 6, 2026, the National Bank of Slovakia (NBS) published a methodological guideline for applicants seeking permission to provide consumer credit under Act No. 312/2025 on Consumer Credit. The guidance, issued as Methodological Guideline No. 5/2026, clarifies the scope of information and documentation required to demonstrate compliance with licensing conditions established by Slovak consumer credit legislation. The guideline specifies requirements for three categories of lenders: those seeking unrestricted permission to provide consumer credit; those seeking permission with limited scope (both legal entities and natural persons); and those seeking permission to provide consumer credit as a supplementary activity. For unrestricted lenders, requirements include legal form (joint-stock company, limited liability company or European company), supervisory board establishment, minimum capital of €500,000, transparent funding sources, and competence and integrity assessments of proposed officers and beneficial owners. Limited-scope lenders face reduced requirements, while natural persons seeking limited-scope permission must demonstrate €5,000 in own funds. All applicants must establish systems for assessing consumer repayment capacity, implement anti-money laundering procedures, create complaint procedures and establish internal control systems proportionate to their complexity and risk profile. The guideline also addresses loan servicers and loan purchasers, requiring them to establish specific internal procedures for loan management, debt collection and anti-money laundering compliance. Applications must be submitted by post or email to the NBS' Financial Market Supervision Department, Consumer Protection and Financial Stability Section. The methodological guideline comes into effect on November 20, 2026.

On July 15, 2026, Albania's Ministry of Finance announced that the Council of Ministers has approved three draft laws designed to modernise the country's financial system and harmonise its legislative framework with European Union directives. The three draft laws propose amendments to the Law on Payment Services, the Law on Payment Systems and the Law on Banks in the Republic of Albania. The proposed changes will deliver concrete benefits for citizens and businesses, including reduced costs for financial services, enhanced security and efficiency within the financial system, strengthened consumer protection, and increased competition and innovation in the market. The legislative package aims to advance Albania's financial market development and support broader economic transformation. The draft laws address payment services regulation, payment system governance and banking sector oversight. By reducing financial service costs and strengthening consumer protections, the reforms seek to create a more competitive and efficient financial environment. The modernisation effort reflects Albania's commitment to EU harmonisation and to the development of its financial sector.

On July 15, 2026, the Anti-Money Laundering Authority (AMLA) published its Annual Report 2025. The report provides an overview of AMLA's institutional development and progress made throughout 2025 across its core responsibilities. These include developing the EU Single Rulebook for anti-money laundering and counter-terrorism financing (AML/CTF), strengthening AML/CTF supervision across member states and supporting cooperation between financial intelligence units (FIU). The consolidated report documents AMLA's efforts to establish itself as the EU's central authority for combating financial crime and money laundering risks across the bloc's financial system. The first planning cycle was initiated during the year. The Work Programme 2025 structured AMLA’s immediate priorities for its foundational year, including governance, recruitment, digital infrastructure, operational readiness and preparatory supervisory and FIU work. Substantive work also started across AMLA’s core mandate. AMLA began work on the Single Rulebook and supervisory convergence, sent two regulatory instruments to the European Commission for adoption and launched its first public consultation in December 2025. The two regulatory technical standards sent to the European Commission concerned the first common methodology for assessing ML/TF risks in the financial sector and the methodology for determining which entities AMLA will select for direct supervision. In parallel, AMLA launched a public consultation on the draft implementing technical standard setting out cooperation between AMLA and national financial supervisors during the selection process and the transfer of supervisory powers. These instruments supported the preparation of AMLA’s future direct supervisory role.

On July 16, 2026, the Australian Signals Directorate (ASD), which operates under the Australian Cyber Security Centre, released a "post-quantum questions to ask your vendors" list, which is new guidance designed to help organisations assess third-party supplier readiness for the transition to post-quantum cryptography (PQC). Advances in quantum computing are expected to undermine widely used traditional public-key cryptographic algorithms. PQC comprises cryptographic algorithms designed to remain secure against attacks from both classical and quantum computers. As organisations prepare for this transition, third-party products and services will play a critical role in supporting the adoption of quantum-resistant cryptography. ASD recommends these questions as part of the checklist: Locate cryptographic dependencies: Organisations should ask vendors to identify where cryptography is used across their products, including in applications, operating systems, hardware, firmware and third-party libraries.Vendors should ideally maintain an up-to-date cryptographic bill of materials, identifying the algorithms, protocols, libraries, keys, parameters and embedded components used by their products. Organisations should also determine whether cryptography is hardcoded, hardware-bound or capable of being updated through patches and firmware upgrades. Assess quantum-related risks: Organisations should understand which customer data flows depend on traditional asymmetric cryptography and whether the data must remain confidential for many years. Vendors should have documented assessments covering: encryption, authentication and digital-signature risks; the sensitivity and expected lifetime of protected data; “harvest now, decrypt later” exposure; certificates, smartcards, tokens and authentication systems; and the impact of a future quantum computer on individual products and services. Prioritise systems for transition: Organisations should establish when each vendor product will become PQC-ready and whether that timetable supports customer migration before the end of 2030. Vendors should disclose: products requiring hardware replacement or major redesign; constraints that could delay migration; how higher-risk customers and sensitive systems will be prioritised; whether temporary hybrid traditional/PQC solutions will be used; and which executives or governance bodies are accountable for the transition. Implement PQC securely: Organisations should ask which standardised PQC algorithms vendors intend to support and when those capabilities will be available in production. Vendors should demonstrate that: their implementation uses recognised, ASD-approved algorithms; cryptographic libraries are reputable and actively maintained; PQC functionality is production-ready rather than experimental; key sizes, certificate sizes and performance implications have been assessed; customers receive clear configuration and deployment instructions; rollback and compatibility risks are managed; and PQC is included in standard licensing rather than sold as an optional premium feature. Communicate and educate: Vendors should provide customers with advance notice of cryptographic changes, transition guidance, testing documentation and clear deprecation schedules for older encryption methods. ASD also expects vendors to train support and engineering staff, maintain updated operational procedures and align their product roadmaps with ASD’s proposed transition timetable. Vendors should also monitor or participate in relevant PQC standards-development bodies. ASD also identifies several responses that may indicate weak PQC preparedness: the vendor cannot identify where cryptography is used; it provides general assurances without product-specific evidence; migration dates are unclear or repeatedly deferred; it relies on proprietary or opaque cryptographic systems; PQC is offered only as a paid premium feature; it relies heavily on temporary compensating controls; or responsibility for the transition has not been assigned internally.

On July 15 2026, the European Central Bank (ECB) published the Guide to the Internal Capital Adequacy Assessment Process (ICAAP), establishing supervisory expectations for credit institutions supervised under the Single Supervisory Mechanism (SSM). The guide applies to all significant institutions as defined under the SSM Framework Regulation and provides transparency on how the ECB assesses compliance with Article 73 of the Capital Requirements Directive (CRD IV). The guide establishes seven core principles governing sound ICAAP implementation. Management bodies must approve all key ICAAP elements and produce annual capital adequacy statements demonstrating their understanding of capital adequacy drivers and vulnerabilities. The ICAAP must integrate into overall management frameworks, linking business strategy, risk appetite, capital planning and decision-making processes. Institutions must assess capital adequacy from two complementary perspectives: a normative perspective ensuring compliance with regulatory and supervisory capital requirements over a medium-term horizon; and an economic perspective ensuring risks are covered by internal capital based on economic value considerations. All material risks must be identified through a comprehensive annual process and documented in an internal risk inventory. Institutions must define high-quality internal capital using prudent and conservative methodologies, with risk quantification approaches subject to independent internal validation. The guide emphasises that institutions should apply conservatism levels comparable to Pillar 1 internal models when quantifying risks. Stress-testing programmes must cover both perspectives, incorporating severe but plausible adverse scenarios reflecting institution-specific vulnerabilities, with reverse stress testing conducted at least annually. The ECB expects institutions to maintain robust capital plans covering at least three years, monitor capital adequacy indicators quarterly and adjust strategies when economic capital falls below internal thresholds. The guide clarifies that proportionality applies to implementation but cannot undermine ICAAP effectiveness. Institutions are encouraged to reference complementary guidance from the European Banking Authority (EBA) and international bodies including the Basel Committee on Banking Supervision (BCBS).

In July 2026, the European Central Bank (ECB) published clarifications on supervisory expectations for banks' internal capital adequacy assessment processes (ICAAPs) and internal liquidity adequacy assessment processes (ILAAPs), building on its November 2018 guidance. The document reminds banks of sound practices for capital and liquidity management and outlines governance expectations around ICAAP and ILAAP package submissions to Joint Supervisory Teams (JSTs). The ECB emphasises that ICAPs and ILAAPs must be continuous processes subject to strong internal governance, including sound approval and regular review procedures throughout the year, independently from supervisory submissions. Capital and liquidity adequacy statements must be produced, agreed and signed by the management body before submission. Banks should conduct forward-looking capital and liquidity adequacy assessments considering both normative and economic perspectives for at least three years, applying baseline and adverse scenarios. The ECB expects banks to demonstrate credibility and robustness of macroeconomic scenarios, identify material risk drivers and conduct granular sensitivity analyses. Regarding stress testing, adverse scenarios must reflect each entity's vulnerabilities and severe external developments, with macroeconomic assumptions reflecting downturns at least as severe as official consensus forecasts. The ECB clarifies expectations on internal capital eligibility, noting that Additional Tier 1 (AT1) instruments typically fail eligibility tests and should not be included in internal capital calculations. Banks must also demonstrate how capital and liquidity planning outcomes inform concrete management decisions, including remuneration, capital allocation, risk appetite setting and dividend distribution policies. Starting with the 2025 supervisory review and evaluation process (SREP), the submission process comprises two components: annual submission of key documents by March 15; and continuous submission of new or significantly revised internal documents throughout the year. Banks must provide capital adequacy statements, liquidity adequacy statements, capital and funding plans, reader's manuals, ICAAP and ILAAP templates via the Short Term Exercise (STE) and financial and capital projections. The reader's manual should confirm document completeness and map information items to submitted documentation.

On July 15, 2026, HM Treasury launched a consultation on revising the fee regime for recognised payment systems, specified service providers, and digital settlement asset service providers under the Bank of England's supervision. The consultation addresses two key areas: First, it proposes expanding the scope of the fee regime to include digital settlement asset service providers, following their inclusion within the Bank of England's remit under the Financial Services and Markets Act 2023 . Digital settlement asset service providers are now subject to Bank of England oversight and the government intends to bring them within the fee framework applicable to other payment system operators. Second, the consultation seeks views on the appropriate level of caps on supervisory and special project fees that can be levied on firms falling within the expanded scope. The fee regime currently applies to recognised payment systems and designated service providers; the proposed changes would create a more comprehensive framework encompassing the emerging digital settlement asset sector. This development is significant for payment system operators and digital settlement asset service providers, as it will determine their regulatory costs and the Bank of England's capacity to fund supervision and special projects related to payment systems infrastructure. The list of recognised payment systems can be found here . The consultation closes on August 31, 2026, 11:59pm, responses can be submitted by email to paymentsystemfees@hmtreasury.gov.uk .

On July 16, 2026, Germany published the Seventh Ordinance Amending the Common Reporting Standard (CRS) Extension Regulation in the German federal gazette. The CRS Extension Regulation establishes Germany's framework for implementing the Common Reporting Standard (CRS), an international automatic exchange of information standard developed by the Organisation for Economic Co-operation and Development (OECD). This seventh amendment modifies the existing regulatory framework governing the scope and application of CRS requirements for German financial institutions and reporting entities. The amendment affects financial institutions, investment firms, and other entities subject to CRS reporting obligations under German law. The regulation applies to entities handling financial accounts and investments that fall within the CRS scope. These entities must comply with enhanced due diligence procedures and automatic information exchange requirements with relevant tax authorities. The Ordinance enters into force on July 17, 2026.

On July 15, 2026, the Reserve Bank of India (RBI) released draft guidance on regulatory expectations for data governance for public consultation The draft guidance contains: Administrative measures detailing the applicability of the guidance to various regulated entities, including commercial banks, small finance banks, payments banks, and non-banking financial companies (NBFCs), among others. Regulations prescribing the establishment of a comprehensive Data Governance Framework (DGF) that covers all material aspects of data governance, aligns with the entity's risk management framework, and complies with applicable laws like the Digital Personal Data Protection (DPDP) Act, 2023. Specific rules mandating the creation of dedicated roles and committees for data governance, such as a Board-level Data Governance Committee (DGC), an executive-level committee, and designated roles for a Data Function head, Data Owner, Data Steward, and Data Custodian. Provisions outlining the lifecycle-based approach to data governance, requiring regulated entities (REs) to manage data from origination to disposal, ensuring that proper metadata, data lineage, and single source of truth (SSOT) arrangements are maintained and traceable. Directives establishing the governance requirements for sharing data with third parties, stipulating that data must only be shared for defined and approved purposes, access must be on a 'need to know' basis, and secure channels with non-disclosure agreements must be utilized. Feedback may be submitted via the RBI's Connect2Regulate platform, by email to dor.datagovfed@rbi.org.in, or by post by August 17, 2026.

On July 15, 2026, the UK Department for Culture, Media and Sport (DCMS) opened a consultation on banning gambling operators not licensed by the Gambling Commission from entering into sponsorship or advertising arrangements across all sectors, including sports. Under current legislation, businesses can enter into advertising and sponsorship arrangements with unlicensed gambling operators provided those operators' services cannot be accessed by consumers in Great Britain. Unlicensed operators prevent access through geo-blocking their websites; however, consumers can circumvent this using virtual private networks (VPNs). This has become particularly prevalent in the sporting sector, notably football, following recent changes in the advertising landscape. The DCMS identified three core objectives driving the proposed legislative changes: Protecting consumers, especially young people and vulnerable individuals, from unregulated platforms that may lack adequate player protections or fraud recourse. Defending the integrity of the domestic market by ensuring advertising footprints are exclusive to operators required to adhere to the Gambling Commission's Licence Conditions and Codes of Practice (LCCP) . Eliminating money laundering vulnerabilities within football clubs and agents flagged in the National Risk Assessment. The current legislation undermines the gambling licensing and advertising regulatory frameworks designed to protect consumers in Great Britain and reduce money-laundering and crime risks. The proposed ban would apply to unlicensed gambling sponsorships and advertising across all sectors in Great Britain. The consultation closes at 11:59pm on September 9, 2026. Responses can be submitted online or emailed to gamblingactreview@dcms.gov.uk .

On July 10, 2026, the Polish government introduced a bill proposing amendments to the Act on Combating Unfair Market Practices and the Consumer Rights Act. Thie bill aims to transpose  European Union Directive 2024/825 which  broadens the scope of unfair commercial practices, introducing prohibitions against greenwashing. The proposed amendments restrict businesses from making misleading environmental declarations about their products, a practice commonly referred to as "greenwashing." The amendments identify new misleading commercial practices, regardless of the accuracy of the information, if the average consumer could be misled about the environmental or social characteristics of a product. The bill has been submitted to the Sejm.

On July 13, 2026, Spain's Ministry of Economic Affairs and Digital Transformation relaunched its Financial Sandbox, a controlled testing environment for innovative financial-sector projects. The reform aims to make the Sandbox more agile for innovators and more accessible to emerging companies while improving the broader financial system. The reform comprises two components. First, legislative updates included in the Draft Law on Digitalisation and Modernisation of the Financial Sector replace the current semi-annual cohort system with a permanent open window, allowing companies to submit projects at any time. Evaluation timelines are reduced by approximately two months, from 6.5 to 4.5 months from application submission to testing commencement. The reform simplifies access by reducing documentation requirements, allowing responsible declarations instead of formal proofs, and requiring financial guarantees only when essential. The definition of innovation expands beyond novel technologies to include business model innovation, process improvements, and novel applications of existing technologies. Thematic calls will enable focused attention on specific regulatory challenges. Second, direct support measures include a dedicated financing line from the Official Credit Institute (ICO) to facilitate access to the Sandbox, particularly benefiting startups and individual promoters. The Ministry will increase visibility through wider dissemination of project conclusion reports in collaboration with the Spanish Association of Fintech and Insurtech (AEFI) and periodic events.

The Cyprus Securities and Exchange Commission (CySEC) published a comprehensive, practical guide outlining procedures for submitting and processing reports of violations of European Union and national law via its external reporting channel. The guide implements Law 6(I)/2022 , which transposed Directive (EU) 2019/1937 on the protection of persons reporting breaches of union law. The guide covers 22 categories of violations falling within CySEC's jurisdiction, spanning financial services, products, and markets. These include breaches of rules governing market conduct and transparency requirements; derivatives trading and reporting; benchmark regulations; credit institutions' prudential requirements; investor compensation schemes; collective investment schemes; market abuse; credit institution governance; settlement systems; and securities financing transactions, among others. The guide clearly sets out the obligations and duties of CySEC as the competent supervisory authority in the financial sector, and, in particular, as the competent external channel for receiving and following up on relevant reports. The guide also defines the categories of natural persons entitled to report to CySEC as the competent external reporting channel. It emphasises comprehensive protection against retaliation for reporters and connected persons, covering dismissal, demotion, discrimination, harassment, and other adverse employment actions. The guide also sets out the timelines and actions to be taken at each stage of the procedure to ensure the lawful, timely, and effective completion of the procedure.

On July 14, 2026, the Malta Financial Services Authority (MFSA) and the Financial Intelligence Analysis Unit (FIAU) launched the Harmonised Regulatory Reporting Framework (HRRF), a modernised standardised mechanism for domestic regulatory reporting. The initiative will be implemented in a phased, sector-by-sector approach to allow financial operators sufficient time to prepare and adapt. The HRRF addresses industry feedback regarding administrative burden by reducing duplication of data requests across different domestic returns, streamlining data requirements through consistent definitions, and improving operational efficiency through standardisation. The framework incorporates a revision of anti-money laundering and counter-terrorism financing (AML/CTF) data points to align with eventual Regulatory Technical Standards issued under Article 40(2) of Directive (EU) 2024/1640 . The implementation is split into two distinct waves: The first will include Financial Institutions, and Crypto-Asset Service Providers (CASPs) - the formal submissions in the new JSON-based format will become mandatory from January 2027. Preparatory milestones are in place with the publication of technical data taxonomies, reporting specifications, and JSON schema definitions to be published. An industry testing phase will occur between August and October 2026. Preparatory milestones are in place with the publication of technical data taxonomies, reporting specifications, and JSON schema definitions to be published. An industry testing phase will occur between August and October 2026. The second wave will include Investment and Securities, Insurance and Pensions, and the remaining Trusts and Fiduciaries. The timeline will be communicated following Wave 1 rollout. Authorised Persons in Wave 1 should assess internal readiness and allocate technical resources ahead of testing.

On July 10, 2026, Greece published Law 5317/2026 in the Official Government Gazette, transposing multiple European Union directives into Greek law. The legislation strengthens consumer protections across consumer credit contracts, financial services, and distance contracts concluded outside premises or electronically. Law 5317/2026 transposes Directive (EU) 2023/2225 on credit agreements for consumers. The law addresses consumer credit matters including expanded scope of application, enhanced transparency in advertising, and improved consumer information requirements. It establishes mandatory creditworthiness assessment procedures and introduces consumer rights including withdrawal rights and early repayment options. The legislation also incorporates provisions on distance provision of financial services, implementing Directive (EU) 2023/2673 into Greek national law. Key provisions regulate pre-contractual information for distance financial services, withdrawal rights, adequate explanations to consumers, and consumer protections regarding use of web interfaces. The consumer credit provisions become effective on November 20, 2026. The provisions governing distance provision of financial services take effect on the law's publication date in the Government Gazette, July 10, 2026. All credit institutions and financial service providers operating in Greece must comply with the new requirements by these effective dates.

On July 14, 2026, Latvia published amendments to its March 25, 2024 regulations on  "Requirements for the Establishment and Control of an Internal Control System for Sanctions Risk Management". The amendments modify requirements for financial institutions operating under Latvia's sanctions framework. The amendments introduce several substantive changes to sanctions risk management obligations which include the following: Institutions must now implement procedures for screening clients, beneficial owners, authorised persons, shareholders, and client transactions against sanctions lists, with a requirement to demonstrate that chosen solutions provide effective sanctions risk management. Group-level institutions must implement group-wide sanctions risk management policies and procedures. Enhanced information technology requirements now mandate functional specifications and regular effectiveness testing aligned with each institution's sanctions risk profile. The amendments establish differentiated review timelines: most institutions must update their sanctions risk assessments at least every three years however credit institutions, licensed payment institutions, licensed electronic money institutions, investment broker firms, and crypto-asset service providers must review assessments at least annually. Institutions must ensure functional independence of sanctions risk management systems from core business functions and to appoint dedicated personnel with appropriate authority and information access. Institutions must notify Latvia's Central Bank within 30 days of appointing or replacing their sanctions risk management officer, providing specified personal and contact details. Institutions that previously submitted incomplete information to Latvia's Central Bank regarding their appointed sanctions risk management officer have until September 1, 2026 to achieve full compliance with disclosure requirements.

On July 14, 2026, Austria's Financial Market Authority (FMA) announced it had imposed a fine of €42,000 on Western Union International Bank GmbH for repeated breaches of digital operational resilience notification obligations under the Digital Operational Resilience Act for the Financial Sector (DORA). The FMA found that Western Union International Bank failed to notify the FMA of major information and communication technology-related incidents within the specified deadlines by submitting several delayed initial and intermediate reports relating to ICT-related incidents. These repeated failures to report in a timely manner constitute breaches of the institution's regulatory notification requirements under DORA. As a result of these breaches, the fine was issued.

On July 15, 2026, the Canadian Securities Administrators (CSA) published Staff Notice 33-322, which summarizes findings from focused compliance examinations of 73 registered firms' cybersecurity practices and provides updated guidance. The examinations reviewed firms registered as investment fund managers, portfolio managers, restricted portfolio managers, and exempt market dealers. Under section 11.1 of National Instrument 31-103 , registered firms must establish, maintain, and apply policies and procedures to manage business risks, including cyber threats. The notice updates previous CSA cybersecurity guidance from 2013 through 2017. Key findings and guidance include: Cybersecurity policies and procedures: While most firms had written policies, 8 percent had none, and 55 percent had policies that could be enhanced. The CSA expect policies to address electronic communications, device usage (firm-issued and personal), loss or disposal of devices, public internet use, third-party oversight, risk assessments, data security and encryption, training, and accountability. Policies should be reviewed annually with documentation maintained. Cybersecurity training: According to the guidance, training should be provided at least annually (more frequently for firms with greater complexity) and cover recognizing risks, threat types, handling confidential information, password use, device security, and incident escalation. Cybersecurity risk assessments and controls: The CSA found 45 percent of firms conducted assessments that could be more robust, and 12 percent had no documentation. The guidance states risk assessments should be conducted at least annually and include an inventory of critical assets, identification of vulnerabilities (including employee access rights), how threats are identified, and adequacy of controls. It further highlighted controls including multi-factor authentication, data encryption, regular backups, and logging of suspicious activity. Third-party service providers: All reviewed firms used third-party providers with access to systems or data. Firms should conduct and document meaningful initial and ongoing due diligence on third-party cybersecurity practices, including requesting System and Organization Controls (SOC) reports or similar attestations, maintaining logs of providers, and updating due diligence questionnaires annually. Cybersecurity incident response plans: According to the guidance, plans should include a definition of a cybersecurity incident, response procedures (including for incidents at third-party providers), data backup and recovery procedures, and notification protocols. The notice emphasizes that firms of different sizes and complexities may implement practices proportionately, but relevant risks must be appropriately addressed. The CSA expects firms to stay current on evolving cybersecurity threats.

On July 14, 2026, the Florida Office of Financial Regulation (OFR) issued a Final Order against Fidelity Direct Mortgage, LLC (Fidelity Direct), a licensed mortgage lender. The order follows a complaint issued in May 2026, alleging multiple violations of Chapter 494, Florida Statutes , and federal mortgage servicing requirements. Key findings of the OFR include: Failure to disburse funds in accordance with agreements: Fidelity Direct collected $3,394.38 for mortgage insurance premiums at closing but failed to apply the funds to the escrow account for 1,826 days, and instead applied collected premiums to principal, interest, and late fees in disregard of the agreement. Mismanagement of escrow funds for insurance: Fidelity Direct failed to timely disburse funds for a borrower's homeowners' insurance premium, causing the insurance to lapse in June 2022. Late payment of property taxes: Respondents failed to pay annual property taxes in a timely manner, paying 2021 taxes late in February 2022. Failure to provide annual escrow analysis statements: Fidelity Direct failed to generate or provide annual escrow account statements to borrowers. Failure to establish loan servicing policies: Fidelity Direct did not maintain policies and procedures for servicing loans. Failure to maintain segregated servicing accounts: Fidelity Direct failed to maintain a segregated set of records and a separate depository account for servicing receipts, instead commingling servicing funds with other transactions. The OFR imposed an administrative fine of $9,750 and a 60-day suspension of Fidelity Direct's mortgage lender license, effective 30 days after the date of the Final Order.

On July 15, 2026, the US Office of Foreign Assets Control (OFAC) announced sanctions against seven individuals and entities operating across Iran, Russia, Nigeria and Italy. These targets are linked to an international weapons procurement network supporting the Islamic Revolutionary Guard Corps (IRGC), a US-designated terrorist organization (DTO). According to OFAC, the IRGC is heavily involved in global weapons production and proliferation, including efforts to acquire man-portable air-defense systems (MANPADS), with the sanctioned individuals and entities playing a crucial role in utilizing foreign aviation firms, financial conduits and travel coordinators to obscure the IRGC's involvement and illicitly move weapons and personnel globally. As a result of the new sanctions, all US-based property and interests of the targeted individuals and entities are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC.

On July 14, 2026, the Mexican National Banking and Securities Commission (CNBV) published a resolution modifying the general provisions applicable to credit institutions in Mexico's official gazette, particularly as they relate to account opening requirements. The resolution harmonises the regulatory framework following amendments issued by the Bank of Mexico and the Ministry of Finance and Public Credit (SHCP) earlier in 2026. Specifically, the resolution updates general provisions to accommodate a new account classifications alongside existing Levels 1, 2, 3 and 4. Key amendments include: Revised customer identification requirements for presential and non-presential account opening across all account levels. Updated provisions for electronic banking contracting. Introduction of "proof of life" requirements (i.e., technical tests using algorithms to verify biometric characteristics and confirm a living subject is present during account opening procedures). Establishment of biometric information databases for customer identity verification. Modified requirements for remote account opening for Level 2  4 accounts, as well as consumer and commercial credit contracts. Credit institutions must notify the CNBV within 20 business days of implementing biometric verification systems. The resolution takes effect on July 15, 2026 .

On July 14, 2026, the Peruvian National Institute for the Defence of Competition and the Protection of Intellectual Property (Indecopi) announced an enforcement action against Banco BBVA Peru SA for failing to adopt necessary security measures to prevent an unauthorised transaction that harmed a consumer. In a second administrative instance decision, Indecopi determined that the bank had not implemented adequate monitoring and alert systems to identify that a transfer to a third party deviated from the consumer's typical spending patterns. According to Indecopi, the bank's failure to detect this unusual operation violated its duty of suitability under Article 19 of the Consumer Protection and Defence Code . As a result, Indecopi imposed a fine of 3.78 tax units (UIT), equivalent to approximately 20,790 Peruvian soles, on Banco BBVA Peru SA . Additionally, Indecopi ordered the bank to reimburse the consumer for the unauthorised transaction amount, associated commissions, expenses and other costs incurred as a result within 15 business days.

On July 14, 2026, the US Office of Foreign Assets Control (OFAC) announced sanctions against more than 50 individuals, entities and vessels linked to an illicit Iranian shipping and sanctions evasion network headed by Mohammad Hossein Shamkhani, which serves as a major financial engine for the Iranian government and military. According to OFAC, Shamkhani's network is heavily involved in Iran's illicit oil exports, global containerized shipping and commodities trading. The sanctioned targets play a crucial role in providing exchange house services, managing shell companies and coordinating global shipping logistics, often utilizing international corporate structures and deceptive trade practices to evade price caps and sanctions. As a result of the new sanctions, all US-based property and interests of the targets are blocked, and US individuals and entities are generally prohibited from engaging in transactions with them, unless expressly authorized by OFAC. Concurrently, OFAC issued Iran-related General License Z , which authorizes limited, temporary wind-down activities, environmental safety transactions and the offloading of cargo involving the newly blocked targets.

On July 8, 2026, the Peruvian Superintendency of Banking and Insurance (SBS) announced a program to strengthen cybersecurity and operational resilience capabilities across Peru's financial sector. The initiative aims to ensure that financial institutions can maintain critical services, including cash withdrawals, immediate payments and transfers, during operational disruptions caused by natural disasters or other events. The new SBS capacity-building program  includes training and crisis scenario simulations, targeting first-line officials at financial institutions. According to the SBS, the program complements ongoing SBS supervisory exercises conducted throughout 2026, including the International Seminar on Operational Resilience and the Fourth Sectoral Business Continuity Exercise. The SBS also stated that the program reflects a growing recognition that as Peru's financial system becomes increasingly digitalised, financial institutions require robust mechanisms to ensure service continuity and protect public access to essential financial services during crises or natural disasters.

On July 14, 2026, the the Reserve Bank of India (RBI) issued the amendment directions to the Reserve Bank of India (Payments Banks - Governance) Directions, 2025. The amended directions contain: Administrative measures detailing the rationalization of extant Reserve Bank of India (RBI) directions to enable bank boards to utilize their time effectively and focus on strategy and risk governance. Regulations prescribing that the board shall exercise oversight on the risk management system, exposures to related entities of the bank, and conformity with corporate governance standards. Specific rules mandating the categorization of matters to be placed before the board, specifying policies for board approval, matters for review or information, and matters that may be delegated to board or management committees. Provisions outlining the key principles for determining board matters, emphasizing that the board has ultimate responsibility for the bank's business strategy, financial soundness, and risk management, while the chairperson holds primary responsibility for setting the meeting agenda. Directives establishing that the board shall periodically review the matters to be placed before it and those delegated, ensuring the timeliness of agenda circulation, adequacy of information, and time allotted for important matters. The amendments take effect on October 1, 2026.

On July 14, 2026, the Reserve Bank of India (RBI) issued the amendment directions to the Reserve Bank of India (Commercial Banks - Governance) Directions, 2025. The amended directions contain: Administrative measures detailing the rationalization of extant Reserve Bank of India (RBI) directions to enable bank boards to utilize their time effectively and focus on strategy and risk governance. Regulations prescribing that the board shall exercise oversight on the risk management system, exposures to related entities of a public sector bank (PSB), and conformity with corporate governance standards. Specific rules mandating the categorization of matters to be placed before the board, specifying policies for board approval, matters for review or information, and matters that may be delegated to board or management committees. Provisions outlining the key principles for determining board matters, emphasizing that the board has ultimate responsibility for the bank's business strategy, financial soundness, and risk management, while the chairperson holds primary responsibility for setting the meeting agenda. Directives establishing that the responsibilities and provisions pertaining to board structure and practices for a public sector bank (PSB) shall apply mutatis mutandis to the board of a private sector bank (PVB). The amendments take effect on October 1, 2026.

On 14 July 2026, HM Treasury and the US Treasury published the initial recommendations of the Transatlantic Taskforce for Markets of the Future (TTMF). The report contains ten recommendations split between digital assets and capital markets, with delivery tracked through the UK-US Financial Regulatory Working Group (FRWG): Digital assets A private sector-led group, established on a one-year basis, for industry experimentation and testing of cross-border tokenised asset use cases, including identifying where regulatory clarity and technical standards are needed. The Bank of England, CFTC, FCA and SEC will seek common approaches to the regulatory treatment of tokenised assets, covering settlement finality of tokenised securities and the potential eligibility of stablecoins and tokenised money market funds as margin collateral at CCPs, with increased use of flexible regulatory mechanisms. The joint stablecoin statement itself, aimed at a dynamic cross-border stablecoin market and regime convergence, though explicitly not supplanting or presupposing the outcomes of ongoing regulatory processes. Support for a "multi-money ecosystem" in which stablecoins, tokenised deposits and other digital money coexist, mirroring the language in the HMT payments consultation. Joint support for a targeted review of Basel Committee standards on the prudential treatment of cryptoassets, so they are future-proofed, technology-neutral and evidence-based. Capital markets FCA and SEC staff to explore options to ease cross-border capital raising and address frictions, reporting via the FRWG. SEC staff developing recommendations on Foreign Private Issuer framework reform will consider the FCA's views on how UK regulatory, disclosure and governance standards should be reflected in the treatment of UK FPIs (following the June 2025 FPI Concept Release). FCA-SEC collaboration on transparency between the UK's incoming consolidated tapes and US equivalents. The CFTC and FCA intend to convert existing temporary no-action relief for UK Swap Execution Facilities into a longer-term substituted compliance determination before it expires, and to refresh supervisory cooperation arrangements. A reaffirmed commitment to globally accepted accounting and auditing standards, with the FCA, PRA and SEC supporting international standard-setting bodies. A joint statement on stablecoins was published alongside it. The statement sets out ten shared UK-US principles to promote convergence between their stablecoin regimes, including full one-to-one backing with high-quality liquid assets, segregation of reserves with holders given priority claims in insolvency, and avoidance of prudential measures requiring inappropriately high levels of ring-fenced resources in each jurisdiction. Most consequentially, both governments commit to exploring a formal pathway for stablecoins issued in one jurisdiction to access the market of the other,

On July 15, 2026, the Australian Securities and Investments Commission (ASIC) announced that the Markets Disciplinary Panel (MDP) fined WealthHub Securities Limited (WealthHub), an online broker owned by National Australia Bank (NAB), A$1.055 million for failing to accurately report regulatory data more than 9.5 million times over a 10-year period. From July 28, 2014 to October 31, 2024, WealthHub failed to provide complete and accurate regulatory data and lacked the necessary organisational and technical resources to comply with its reporting obligations under the ASIC Market Integrity Rules. The MDP identified that WealthHub repeatedly failed to provide or provided incorrect Intermediary ID information, the Australian Financial Services (AFS) licence number of the financial services entity responsible for placing orders and trades, in orders and trade reports submitted to market operators, including the Australian Securities Exchange (ASX). The Intermediary ID is critical for ASIC to accurately identify orders and trading patterns, detect misconduct such as insider trading and market manipulation, and calculate industry funding levies. The MDP found that WealthHub lacked the capacity, capability, and appropriate resources to identify and remediate breaches in a timely manner. The panel noted that WealthHub missed multiple opportunities to address the root cause of failures, failed to take adequate corrective action, and did not lodge a reportable situation report to ASIC until January 2023. The MDP emphasised that market participants bear responsibility for maintaining and regularly reviewing technology systems and ensuring they employ people with appropriate expertise to identify and address reporting issues. WealthHub, a wholly owned subsidiary of NAB, operates as a market participant and trading participant of the ASX Market and Cboe Market, providing execution, clearing and settlement services through nabtrade and its private wealth business JBWere Ltd. WealthHub has complied with the infringement notice and paid the fine. Payment does not constitute an admission of guilt or liability.

On June 30, 2026, the Sanctions Commission of the National Gambling Authority (Autorité Nationale des Jeux — ANJ) imposed a €500,000 fine against an online gambling operator for failing to identify and support players engaged in excessive or pathological gambling. The ANJ's sanctions body confirmed breaches of player protection obligations during an administrative investigation conducted as part of the regulator's control programme. The ANJ examined 30 players presenting a manifest risk of excessive or pathological gambling between October 1, 2023, and March 31, 2024, using seven indicators derived from the ANJ's reference framework for preventing excessive gambling and protecting minors. These indicators included deposit frequency, number of lost deposits, gaming frequency, high bet amounts, modifications to legal gaming moderators, self-exclusion activation, and multiple accounts opened by individual players. The investigation revealed the operator failed to identify almost all sampled players as presenting a risk, with some players not identified at all and others classified at insufficient risk levels relative to their actual gaming behaviour. The operator also failed to implement graduated and proportionate support measures to moderate players' gaming activity. The Sanctions Commission determined the breaches were serious, substantial in nature, significantly impactful, and sustained over the investigation period. The €500,000 sanction reaffirms the ANJ's position that operator compliance with player identification and support obligations is central to the regulatory framework. The operator may appeal the decision to the French administrative court (Conseil d'État) within two months of notification.

On July 14, 2026, the Arizona Department of Gaming (ADG) announced that it will begin accepting applications for limited event wagering licenses starting August 13, 2026. Limited event wagering licenses allow operators to partner with racetracks or additional wagering facilities holding permits issued by the Division of Racing, commonly known as off-track betting locations. The ADG may issue up to ten licenses at ten specific locations, as described in A.R.S. § 5-1307 . The application window runs from August 13, 2026 to August 27, 2026 at 5 p.m. Arizona time. The ADG will evaluate all applications in accordance with established criteria set forth in applicable rules and statutes, with a focus on consumer protection. Limited event wagering operations will enable Arizonans to participate in retail-style sports betting at racetracks, with eight percent of adjusted retail event wagering revenue subject to event wagering privilege fees. Applicants seeking further information can visit the Arizona Department of Gaming Forms, Licensing, and Fees web page or the Frequently Asked Questions page. The ADG encourages applicants to review all applicable rules and statutes before submitting applications during the designated window.

On July 14, 2026, HM Treasury published an independent artificial intelligence (AI) adoption plan for the United Kingdom's financial services sector, developed by the government's AI Champions for financial services. The report outlined ten recommendations: Regulators to make expectations clearer and support more navigable, including a possible Financial Services AI Adoption Support Hub combining an information portal with access to supervisory experts. The FCA to comprehensively review the consumer, competition and wider impacts of advice-like outputs from general-purpose LLMs, feeding into HMT's perimeter considerations. Industry to adopt a voluntary, consistent consumer disclosure distinguishing regulated from unregulated AI-driven guidance. Accelerate the Critical Third Party regime, assessing key AI and cloud providers for designation. www An industry-wide, unattributed AI incident and near-miss sharing repository. A voluntary industry-led AI third-party assurance scheme to cut duplicative firm-by-firm due diligence. Skills measures, spanning the Financial Services Skills Compact, a sector-wide AI skills plan, and visa reforms to attract global AI talent. Leverage HMT's payments consultation to build an agentic payments trust framework on three pillars, namely legal and liability frameworks, Know Your Agent (KYA) identity protocols, and interoperable authentication and governance standards. HM Treasury welcomed the adoption plan and accepted the recommendations directed at the government. The government committed to working with regulators and industry on next steps to implement the recommendations. This work will be considered alongside other relevant developments, including the Mills Review.

On July 14, 2026, the European Central Bank (ECB) announced the selection of 36 payment service providers (PSP) from across the euro area to participate in a digital euro pilot programme. The pilot will test the digital euro's technical functionality, operational processes, and user experience to support preparatory work for the potential issuance of a digital euro. The pilot is scheduled to commence during the second half of 2027 and will run for 12 months. Following a call for expression of interest in March 2026, the Eurosystem received more than 50 applications from PSPs. The selected participants, including banks and non-bank service providers, span diverse business models and sizes with broad geographical coverage across the euro area. A list of the selected participants can be found here . The ECB evaluated applicants against pre-defined eligibility criteria to ensure a representative testing environment. The pilot will use a beta version of the digital euro that is functionally and technically aligned with draft legislation but will not carry legal tender status. Selected PSPs will operate in two roles: distributing PSPs will provide Eurosystem staff access to beta digital euro services, including account setup and payments; and acquiring PSPs will serve selected merchants and enable them to receive beta digital euro payments. Some providers will perform both roles. The pilot will operate across the ECB and 19 national central banks in Belgium, Germany, Estonia, Ireland, Greece, Spain, France, Croatia, Italy, Cyprus, Latvia, Lithuania, Luxembourg, the Netherlands, Austria, Portugal, Slovenia, Slovakia and Finland. Participants will include ECB and national central bank staff, e-commerce merchants and everyday service merchants such as cafeterias and restaurants. Staff will conduct beta digital euro transactions both person-to-person (online and offline) and person-to-business (at physical points of sale and via e-commerce). Selected PSPs will now collaborate with their respective national central banks and the ECB to prepare for the pilot exercise. Progress updates will be regularly published on the ECB's dedicated digital euro pilot webpage.

On July 15, 2026, Council Decision (CFSP) 2026/1364 was published in the Office Journal of the European Union. The decision imposed restrictions on 45 entities responsible for actions undermining or threatening the territorial integrity, sovereignty and independence of Ukraine, in particular due to their involvement in Russia's military-industrial complex and shadow fleet. This decision comes into effect on July 15, 2026.

On July 15, 2026, the UK government's Department for Science, Innovation and Technology (DSIT) launched a call for evidence seeking practical, experience-based insight into whether the United Kingdom's data regime is enabling trustworthy data flows. The consultation invites stakeholders to provide views on how data is currently used across the UK and whether existing frameworks support the maximisation of data's potential for driving growth and improving lives. The call for evidence aims to inform the government's approach to data policy and regulation. By gathering evidence from practitioners and organisations with direct experience of data flows, DSIT intends to assess whether current arrangements facilitate the secure, efficient movement of data while maintaining appropriate safeguards. The call for evidence covers the following thematic areas: Awareness and behaviour around international transfers. Understanding and use of international transfer mechanisms. Balancing compliance with accountability. Ensuring trust in the face of a changing world The deadline for this call for evidence is 11:59 pm on September 9, 2026. Responses can be submitted through the consultation portal .

On July 13, 2026, the Australian Competition and Consumer Commission (ACCC) announced the commencement of new obligations requiring non-bank lenders to share product data through the Consumer Data Right (CDR ). Non-bank lenders, including mortgage lenders, car finance providers, personal loan providers, and buy now, pay later providers, must now disclose information such as interest rates, fees, charges, and eligibility criteria through the CDR framework. The CDR is an economy-wide open banking reform that commenced in 2020 when major banks began sharing data. The scheme has since expanded across banking and energy sectors, and now extends to non-bank lending. The ACCC said the expansion gives consumers access to information about a broader range of financial products and will help them compare mortgages, car finance, personal loans, and other credit products more effectively. ACCC Commissioner Dr Ian Oppermann said the inclusion of non-bank lenders will give consumers a more complete picture of major household costs and enable them to consider whether switching lenders could provide better value. More than 1.3 million Australians currently use the CDR, representing a 135 percent increase over the previous year. At least 35 new data holders will enter the CDR as part of this expansion. Consumer data sharing for non-bank lenders will be phased in from November 9, 2026, depending on provider size. The CDR is an opt-in service giving consumers full visibility and control over who accesses their data and for what purpose.

On July 14, 2026, the Australian Cyber Security Centre (ACSC) released a joint advisory with international partners warning of network device exploitation by cyber actors linked to the Russian Federal Security Service (FSB) Centre 16. The advisory details how these state-sponsored actors target internet-facing networking devices by identifying exposed management services, weak security settings, and known vulnerabilities. Once exploited, cyber actors steal network information and user credentials to conduct further malicious activity. The ACSC identifies organisations in communications, defence, energy, financial services, government, healthcare, and critical infrastructure sectors as facing increased risk from this activity. The advisory emphasises the importance of securing network devices and remediating known vulnerabilities. The ACSC recommends that organisations assess whether this activity could affect their networks and take immediate action to reduce risk. Key mitigation measures include applying security updates, strengthening network security controls, and securing internet-facing network devices. The ACSC notes these recommendations extend beyond Russian state-sponsored threats and can help organisations defend against techniques used by other malicious cyber actors.

On July 14, 2026, HM Treasury launched a consultation on the government's approach to modernising payment services regulation in the United Kingdom. The consultation seeks views on how the regulatory framework should adapt to support innovation in the payments sector whilst maintaining strong consumer protections. The consultation addresses the following areas: Approach to updating existing regulatory requirements :  This includes the scope of regulated activity, authorisation and registration processes, information requirements for payment services, rights and obligations in relation to the provision of payment services, issuance and redeemability of electronic money, prudential and safeguarding requirements, and enforcement powers. Responding to new developments in payment services :  Sets out the Government's proposed reforms to accommodate innovation, chiefly bringing stablecoins and tokenised deposits into the payments perimeter and enabling agentic AI payments, while managing financial inclusion and financial crime risks. Unlocking the future of Open Banking : Sets out the long-term regulatory framework for Open Banking, modernising the Rights of Access in the PSRs and delegating powers to the FCA under the Data (Use and Access) Act 2025 to regulate participants, the Future Entity and commercial schemes. The consultation closes on October 6, 2026, at 11:59pm, responses can be made by email to modernisingpaymentservices@hmtreasury.gov.uk .

On July 9, 2026, Ukraine’s State Agency PlayCity announced that it had imposed a total fine of approximately UAH4.75m (€92,970) on Slots UA Ltd. The online casino and betting operator had failed to meet its obligation to minimise the negative impact of gambling and failed to comply with the orders of the regulatory authority. The decision may be challenged in the administrative court within three months from the date it becomes binding.

On July 7, 2026, the National Bank of Moldova published Regulation on the treatment of credit risk according to the internal rating model approach. The regulation establishes a framework for how credit institutions operating in Moldova must treat credit risk when using internal ratings-based models. This approach aligns with international prudential standards sets out requirements for banks to develop, validate, and maintain internal rating systems that assess the creditworthiness of borrowers and exposures. It specifies governance requirements, including the need for adequate oversight structures, risk management procedures, and independent validation mechanisms. Banks must ensure their internal models accurately measure credit risk across their portfolios and comply with minimum standards for model development, testing, and ongoing monitoring. The regulation applies to all licensed credit institutions in Moldova that use or intend to use internal ratings-based approaches for calculating capital requirements. The regulation enters into force on July 1, 2027.

On July 13, 2026, the Mayor of Belo Horizonte, Álvaro Damião, signed Decree No. 19.654, which prohibits fixed-odds betting operators from advertising on street furniture, municipal properties, and public events. The decree amends Decree No. 14.060, which regulates the Code of Conduct of the Municipality of Belo Horizonte. The measure applies to both static and digital advertising structures and extends to municipal concessions, permits, and authorizations. The decree establishes a 100-meter exclusion zone around schools, museums, and public facilities and services intended for children, adolescents, and young people. Advertising structures directed at or likely to encourage betting by this public are prohibited within this radius. Municipal organs and entities have 15 working days from the decree's publication to review current administrative acts and contracts and cease dissemination of advertising materials that violate the prohibition. This decree comes into effect for gambling operators and advertisers immediately .

On July 14, 2026, the Prudential Regulation Authority (PRA) published policy statement PS16/26, finalising rule changes to accommodate HM Treasury's Overseas Prudential Requirements Regime (OPRR). The policy statement provides feedback on consultation paper CP3/26 and sets out the PRA's final policy amendments to multiple parts of the PRA Rulebook, including Credit Risk, Large Exposures, Market Risk, Settlement Risk, and Reporting provisions. Having considered the response to CP3/26, the PRA has made the following changes: Clarificatory changes to the draft policy material where it considers this to be appropriate, as set out in Chapter 2 Further minor changes to Statement of Policy (SoP) 5/15 and introduced amendments to SoP5/25 , Supervisory Statement (SS) 31/15 and SS4/25 . Amended the instructions for FSA076 Pillar 2 Credit risk standardised approach (SA) and updated the cross-reference to these instructions in SS32/15 . These changes are intended to reflect the introduction of the OPRR and the revocation of the CRR. Further minor corrections to SoP5/25 . These changes are not expected to have a different impact on firms (including mutuals) compared to the rules in CP3/26, other than to make it easier for firms to interpret the rules. The PRA therefore considers that these changes are not ‘significant’. As set out in CP3/26, the PRA  retains its intention to consider its approach to updating references to broader reporting and disclosure instructions alongside any broader changes that may need to be made to reflect the restatement of CRR provisions in the PRA Rulebook in due course. The amendments apply to PRA-authorised UK banks, building societies, PRA-designated UK investment firms, and their qualifying parent undertakings. The new rules take effect on January 1, 2027, alongside the PRA's implementation of Basel 3.1 standards. Implementation depends on the Overseas Prudential Requirements Regime (Credit Institutions and Investment Firms) Regulations 2026 being made and in force prior to that date.

On July 14, 2026, the Financial Conduct Authority (FCA) launched a consultation on proposals to reform remuneration rules for solo-regulated firms, which include Alternative Investment Fund Managers (AIFM), Undertakings for Collective Investment in Transferable Securities management companies (UCITS) and MIFIDPRU investment firms. CP26/27 contains the following proposals: Replace the three existing remuneration codes (the AIFM Remuneration Code (SYSC 19B), the UCITS Remuneration Code (SYSC 19E) and the MIFIDPRU Remuneration Code (SYSC 19G)) with a single, consolidated new code for in-scope solo-regulated firms (SYSC 19AA). Move away from detailed, prescriptive rules towards a more outcomes-focused approach based on firm governance and accountability. Revoke the MIF008 remuneration reporting template and the corresponding reporting requirement for MIFIDPRU firms. Refocus the scope of the remuneration regime so that it applies only to firms that pose greater potential risks to consumers and markets. Introduce greater flexibility in deferral, malus and clawback, with responsibility resting more heavily on firms’ governance structures and the management body’s judgement. Simplify and update definitions and terminology to reflect the new code and the removal of the existing ones. Make consequential amendments across the Handbook, including to the glossary, SYSC and other relevant sourcebooks. Set out transitional and sequencing arrangements, including how the new code would apply alongside forthcoming changes to the AIFM framework, so firms are clear about how and when requirements would take effect. Revoke existing non-Handbook guidance where it’s no longer relevant and incorporate elements into the new code. The consultation closes on September 16, 2026. Responses can be submitted via the FCA's online response form or by email to cp26-27@fca.org.uk . The FCA anticipates publishing a policy statement in Q1 of 2027, with the new remuneration rules and guidance coming into force the day after publication.

On July 14, 2026, Australia's Federal Court ordered the winding up of First Mutual Private Equity Pty Ltd (First Mutual) and an unregistered managed investment scheme operated by it and Gregory Raymond Cotton following an application by the Australian Securities and Investments Commission (ASIC). ASIC sought the winding up to protect current and potential investors and to facilitate the orderly administration of remaining assets. The liquidators will now take control of First Mutual, identify and recover available assets, assess claims, and distribute any recovered funds to creditors and investors where possible. This appointment replaces prior court-ordered receivers and asset freezing orders that had been in place. The action follows ASIC's August 2025 application to freeze bank accounts of Mr. Cotton and First Mutual to safeguard investor funds during its investigation. The Federal Court subsequently appointed receivers to investigate the financial position of First Mutual, including identifying investor funds received and how those funds were used. The Receivers' Report detailing these findings is available on the Federal Court website. ASIC's investigation into First Mutual and Mr. Cotton remains ongoing. Investors seeking information about the winding up process or their claims can access further details through ASIC's dedicated First Mutual Private Equity page and the Federal Court website. The liquidators will manage the distribution of any recovered assets to affected parties.

On July 26, 2026, the Australian Securities and Investments Commission (ASIC) applied to the Supreme Court of New South Wales to wind up Capital Guard AU Pty Ltd (Capital Guard) on just and equitable grounds. ASIC is seeking the appointment of an independent liquidator to take control of Capital Guard, investigate its affairs, and preserve and recover assets where possible. ASIC has serious concerns about Capital Guard's management and the handling of investor funds. The authority identified multiple breaches: Capital Guard appears to have promoted bond investments that may not have existed or were misrepresented to investors Investor funds appear to have been used inconsistently with how Capital Guard represented they would be deployed Capital Guard provided false information to its auditor Capital Guard experienced a breakdown in governance and management, failing to comply with regulatory and reporting obligations. ASIC's investigations indicate that Capital Guard raised approximately A$17.4 million from around 80 investors, with only a small proportion of those funds remaining in known Capital Guard bank accounts and payment platforms. ASIC cancelled Capital Guard's Australian Financial Services (AFS) licence on June 29, 2026, after finding it had engaged in serious misconduct, including promoting a fake Macquarie Bank bond, providing false documents to its auditor, and making misleading statements on its website. On July 3, 2026, ASIC placed Capital Guard on its Moneysmart Investor Alert List following the licence cancellation, and the company's website was taken down. The Supreme Court has listed the matter for a directions hearing on July 20, 2026. ASIC's investigation into Capital Guard and related persons and entities remains ongoing.