Published

In a decision dated June 22, 2026, the Hungarian National Bank (MNB) issued decision H-STA-I-15/2026 against Momentum Credit Zrt., a financial services provider, for failing to meet regulatory reporting deadlines. The MNB determined that Momentum Credit failed to submit audited supervisory reports to the central bank's information system by the deadline specified in MNB Regulation 55/2024 (December 3, 2024). The regulation requires financial institutions to submit specific audited data-based reports covering rows 1–3, 12–32, 34, and 35 of the summary table in Annex 4, along with associated supporting documentation. These reports are mandatory for the MNB to perform its supervision of money and credit market organisations. Momentum Credit submitted the required audited supervisory reports late, breaching its statutory data reporting obligations. The MNB issued a formal notice requiring Momentum Credit to comply fully with all future data reporting obligations mandated by law or MNB administrative decisions and to demonstrate lawful conduct. The MNB warned that repeated violations of laws and MNB decisions within its supervisory scope may result in further enforcement measures, including financial penalties ranging from HUF100,000 to HUF2bn (or 200 percent of the company's annual supervisory fee if higher), or revocation of its operating licence, in accordance with the Act on Credit Institutions and Financial Enterprises (Act CCXXXVII of 2013).

On June 23, 2026, the Central Bank of Malta published a Notice on Supervisory Expectations for Fraud Risk Mitigation in the Instant Payments Environment, addressed to payment service providers (PSPs) operating in Malta. The publication follows the entry into force of Regulation (EU) 2024/886 on instant credit transfers in euro (Instant Payments Regulation - IPR), which introduces measures to strengthen security and consumer protection in instant payments. The Notice sets out the Central Bank's supervisory expectations regarding the prevention, detection, and management of payment fraud, with a particular focus on authorised push payment fraud, impersonation scams, and other emerging fraud typologies. The supervisory expectations cover transaction monitoring, customer authentication, payment verification, spending limit management, device registration controls, customer awareness initiatives, information-sharing arrangements, staff training, and governance and oversight arrangements. The notice provides guidance on the Central Bank’s expectations for PSPs to consider and implement, taking into account the nature, scale, and complexity of their activities. The Central Bank considers these supervisory expectations an important step towards the future fraud-prevention framework envisaged under the forthcoming Payment Services Regulation (PSR), which is expected to further strengthen fraud monitoring, intervention, and consumer protection measures across the European Union. Payment service providers must review their existing controls and align their fraud-prevention frameworks with supervisory expectations by July 1, 2027.

On July 13, 2026, HM Treasury published the Financial Conduct Authority's (FCA) 2026 annual response, which outlines how the FCA's Strategy aligns with the government's economic priorities. Key takeaways from the response include: Supporting Growth and Trade : The FCA established the Office for Investment in October 2025 and implemented the Berne Financial Services Agreement in January 2026 to facilitate sustainable lending, investment, and cross-border trade with Swiss firms. Driving Innovation : To foster market competition and innovation, the FCA launched an Open Finance roadmap in April 2026 and utilizes tools like the AI Supercharged Sandbox and Digital Securities Sandbox. Aiding High-Growth Firms : In May 2026, the regulator introduced a joint Scale-Up Unit and pre-application support services designed to help innovative, high-growth companies navigate market entry. Advancing Sustainable Finance : Following the publication of its transition finance pilot findings in May 2026, the FCA intends to finalize new rules for ESG Ratings providers by the end of 2026. Regulatory Reforms : The FCA is engaged in significant capital market reforms and released final rules and guidance for a new crypto asset regulatory regime in June 2026. Pensions and Consumer Protection : The FCA is collaborating on government efforts to consolidate pensions and, alongside other regulators, is working to introduce a Value for Money Framework for workplace Defined Contribution schemes. Combating Financial Crime : The agency highlighted coordinated anti-crime efforts, including a January 2026 campaign for its "Firm Checker" tool and international enforcement actions taken against illegal "finfluencers" in April 2026.

On July 13, 2026, the Malta Financial Services Authority (MFSA) imposed an administrative fine of €40,560 on Everest Network Ltd, a virtual financial assets (VFA) service provider, following an investigation. The MFSA's investigation identified two categories of failings. First, the company failed to obtain necessary authority approvals prior to undertaking changes to its shareholding structure among existing shareholders, in breach of Article 28(1)(c) of the Virtual Financial Assets Act and Rule R3-2.3.4.4.2(iii) of the Virtual Financial Assets Rulebook Chapter 3 . Second, the company failed to submit certain regulatory reporting documents within the stipulated deadlines for the financial years 2022, 2023 and 2024, as required under the VFA Rulebook. Following Everest Network Ltd.'s demonstration of goodwill, the MFSA agreed on July 10, 2026 to settle all pending matters with the company.

In a decision dated December 2024, France's General Directorate for Competition, Consumer Affairs and Fraud Prevention (DGCCRF) imposed a €300,000 fine on Banque Populaire Val de France for engaging in deceptive commercial practices. Following an investigation between September and December 2024, the DGCCRF established that Banque Populaire Val de France had misled consumers by offering credit products that appeared to be earmarked credits but were not. By misrepresenting standard credits as earmarked credits, the bank offered consumers fewer protections than they believed they were receiving.

In a decision dated February 20, 2026, the Hungarian National Bank (MNB) issued decision H-STA-I-2/2026 against OPM Credit Zrt. for breaching data reporting obligations. The MNB determined that OPM Credit failed to submit audited supervisory reports by the required deadline for the 2024 reporting period. The breach concerned specific rows in the summary tables of MNB Regulation 57/2023 (November 24, 2023) and MNB Regulation 55/2024 (December 3, 2024), which require financial organisations to provide audited data-based reports to the central bank's information system to support the MNB's supervisory functions. OPM Credit submitted these reports late, along with their mandatory supporting documentation. The MNB warned that repeated violations of laws and MNB decisions within its supervisory scope may result in further enforcement measures, including financial penalties ranging from HUF100,000 to HUF2bn (or 200 percent of the company's annual supervisory fee if higher), or revocation of its operating licence, in accordance with the Act on Credit Institutions and Financial Enterprises (Act CCXXXVII of 2013).

In a decision dated May 22, 2026, the Hungarian National Bank (MNB) issued decision H-STA-I-13/2026 against Milton Investment Zrt. for failing to meet regulatory reporting deadlines. The MNB determined that Milton Investment Zrt. failed to submit quarterly supervisory reports to the central bank's information system by the required deadline for the first quarter of 2026. The reports were required under MNB Regulation 43/2025 (December 4, 2025) concerning data submission obligations for the MNB's supervision of money and credit market organisations. The MNB warned that repeated violations of laws and MNB decisions within its supervisory scope may result in further enforcement measures, including financial penalties ranging from HUF100,000 to HUF2bn (or 200 percent of the company's annual supervisory fee if higher), or revocation of its operating licence, in accordance with the Act on Credit Institutions and Financial Enterprises (Act CCXXXVII of 2013).

In a decision dated July 10, 2026, the Hungarian National Bank (MNB) issued enforcement decision H-STA-I-23/2026 against Quality Finance Consulting Kft., an independent financial intermediary. The MNB determined that Quality Finance Consulting Kft. failed to comply with mandatory data reporting obligations under MNB Regulation 55/2024 (December 3, 2024), which establishes supervisory reporting requirements for money and credit market organisations. The MNB's continuous monitoring of statutory data submissions identified deficiencies in the intermediary's annual supervisory reporting for the 2025 reporting period. The MNB decision requires Quality Finance Consulting Kft. to submit the outstanding annual supervisory reports, including all required annexes, within five working days of the decision becoming final. The reports must be submitted in the format, content and manner specified by MNB Regulation 55/2024. The MNB also called upon the intermediary to ensure full compliance with all future data reporting obligations established by law or MNB authority decisions and to demonstrate lawful conduct. The MNB warned that repeated violations of laws and MNB decisions within its supervisory scope may result in further enforcement measures, including financial penalties ranging from HUF100,000 to HUF2bn (or 200 percent of the company's annual supervisory fee if higher), or revocation of its operating licence, in accordance with the Act on Credit Institutions and Financial Enterprises (Act CCXXXVII of 2013).

On July 10, 2026, the Information Commissioner's Office (ICO) consulted on its draft corporate strategy. The consultation seeks views on the ICO's proposed purpose, strategic outcomes, and regulatory and transformation priorities. The consultation follows the UK Data Use and Access Act, which confirmed in June 2025 the ICO's transition from a single Information Commissioner model to a Commission structure comprising a non-executive Chair, Board, and separate Chief Executive. The ICO describes this structural change as modernising the organisation, strengthening resilience, and bringing greater diversity to its strategic direction. The consultation covers the following areas of the ICO: Statutory duties Purpose Strategic outcomes Risks and priorities Regulatory approach The consultation closes on August 23, 2026, at 23:59 (GMT) and responses should be made through the online response form .

In a decision dated July 10, 2026, the Hungarian National Bank (MNB) issued enforcement decision H-STA-I-26/2026 against SNAPA-ADVISORY Kft., an independent intermediary, for failure to comply with statutory reporting obligations. The MNB identified non-compliance during its continuous oversight of legally mandated data submissions. SNAPA-ADVISORY Kft. failed to submit annual supervisory reports required under MNB Regulation 55/2024 (December 3, 2024) for the 2025 reporting period. The regulation specifies reporting requirements in Annex 8 of the summary table, rows 9 and 10, which require annual frequency submissions along with accompanying schedules and appendices. The MNB decision requires SNAPA-ADVISORY Kft. to submit the outstanding annual supervisory reports within five working days from the date the decision becomes final, in the format, content and manner specified by MNB Regulation 55/2024 (December 3, 2024). The MNB warned that repeated violations of laws and MNB decisions within its supervisory scope may result in further enforcement measures, including financial penalties ranging from HUF100,000 to HUF2bn (or 200 percent of the company's annual supervisory fee if higher), or revocation of its operating licence, in accordance with the Act on Credit Institutions and Financial Enterprises (Act CCXXXVII of 2013).

On July 13, 2026, Spain's National Securities Market Commission (CNMV) initiated a public consultation on a draft circular designed to simplify regulatory requirements for collective investment institution (CII) managers and investment services companies. The draft circular modifies four existing circulars to streamline obligations concerning periodic public disclosure of information by collective investment institutions, internal control standards for CII managers and procedures for updating CII prospectuses following regulatory changes. The CNMV simultaneously proposes repealing nine circulars that regulate various aspects of collective investment institutions and investment services companies, which current legislation has rendered obsolete, redundant or no longer fit for purpose. This initiative forms part of the CNMV's broader supervisory simplification plan, which aims to review active circulars to eliminate unjustified procedural requirements unrelated to risk management or investor protection, while promoting proportionality in regulation. Interested parties are called to submit written comments by September 8, 2026, via email to supervisioniicecr@cnmv.es .

On July 13, 2026, the European Union (EU) published Council Implementing Regulation (EU) 2026/1714 of 13 July 2026 implementing Regulation (EU) 2019/796 concerning restrictive measures against cyber-attacks threatening the Union or its Member States in the Official Journal of the European Union. The EU exposed the 16th Centre of Russia's Federal Security Service (FSB) as controlling multiple cyber threat groups, including TURLA. The FSB has conducted extensive malicious cyber activities affecting EU member states and Ukraine for years, including infiltration of governmental networks and sabotage of critical infrastructure. France, Germany, Poland, Cyprus, the Netherlands, Austria, Slovakia, Romania, and Finland have been targeted. Specific incidents include cyber espionage against French strategic governmental entities and defence industry since 2010 and 2025 respectively; targeting of German governmental entities; and disruptive sabotage operations against Polish critical infrastructure, including combined heating and power plants. The EU statement also identified cybercriminals, self-proclaimed hacktivists, and private companies linked to Russia as conducting, enabling, and facilitating malicious activities under Russian instruction, direction, or control. These actors have targeted public services and critical infrastructure, causing disruptions and financial losses across member states. In response, the EU imposed restrictive measures on nine individuals and four entities, including GRU intelligence officers, cybercriminals, self-proclaimed hacktivists, and private companies contributing to Russia's destabilisation efforts. The EU emphasised coordination with the United Kingdom on assessing the convergence between non-state and state actors, and committed to strengthening cooperation with international partners, including NATO. The statement reaffirmed that all states, including Russia, should adhere to United Nations frameworks on responsible state behaviour in cyberspace and respect international law. The list of sanctioned entities can be found here . This regulation shall enter into force on July 13, 2026, and shall be directly applicable in all member states.

On July 9, 2026, the Dubai Financial Services Authority (DFSA) published Consultation Paper No. 174 proposing miscellaneous amendments to its regulatory framework covering crypto and investment token definitions, credit rating agencies (CRAs) and prudential regulatory reporting. The proposals are intended to improve regulatory clarity, align the DFSA Rulebook with international standards, and ensure reporting requirements reflect recent prudential reforms. The consultation proposes amending the definition of a Fiat Crypto Token so that only tokens backed exclusively by the same fiat currency, or financial assets denominated in that currency, qualify as Fiat Crypto Tokens. It also proposes refining the definitions of Privacy Token and Privacy Device to ensure prohibitions apply only where anonymity features create heightened financial crime risks, while narrowing the definition of Investment Token to improve legal certainty and avoid unintended regulatory gaps for tokenised securities and derivatives. The DFSA also proposes targeted amendments to the CRA regime by narrowing employee conflict-of-interest restrictions to relationships that may reasonably give rise to actual or perceived conflicts, while removing certain disclosure requirements relating to fees and charges and the public availability of information used in credit ratings for structured financial products. The regulator considers these requirements broader than necessary and inconsistent with current international standards and IOSCO guidance . Finally, the consultation proposes updating prudential regulatory reporting requirements to reflect changes introduced through previous consultations on prudential standards, enabling the DFSA to collect additional supervisory data and monitor firms' ongoing compliance with the Rulebook . The regulator intends to test the revised reporting forms with industry before implementation. Stakeholders wishing to comment on the proposals must submit their responses via the DFSA's online consultation process by August 24, 2026.

On July 14, 2026, the Decision to Freeze Assets (No. 2026/1) was published in the official gazette. Restrictive measures were placed on three entities for violations under Law No. 6415 on the Prevention of Financing Terrorism, including: Kalyon Inc. International Journalists Association. Free Journalists Association. This decision enters into force on July 14, 2026.

On July 10, 2026, the Bank of Lithuania published a decision amending its December 6, 2012 resolution on mandatory information reporting requirements for consumer credit lenders. The amendment modifies the rules governing how consumer credit providers must report information to the Bank of Lithuania. The decision introduces updated reporting procedures and timelines for information submission, establishing clearer requirements for financial institutions operating in the consumer credit lending sector. The amendments affect the mandatory reporting obligations previously established under the original 2012 resolution, which set out standardised information submission protocols for these market participants. The amended rules establish requirements across multiple reporting categories, including consumer information, credit institution data, and peer-to-peer lending platform operator capital reporting. The decision includes specific reporting forms, such as the VKD01 form for consumer credit provider activity reports, along with detailed completion instructions. The amendment enters into force on November 20, 2026.

On July 10, 2026, Australia's Department of the Treasury enacted the Reserve Bank Regulations 2026, a legislative instrument authorised under the Reserve Bank Act 1959 . The Reserve Bank Regulations 2026 establish the regulatory framework governing the operations and administration of the Reserve Bank of Australia (RBA). The regulations primarily deal with confidentiality and the handling of protected Reserve Bank of Australia information. They regulations: prescribe the secrecy declaration that members of the RBA’s Monetary Policy Board, Payments System Board and Governance Board must make; identify government agencies and international bodies with which protected information or documents may be shared under the Reserve Bank Act; apply the information-sharing provisions to information obtained and documents produced both before and after the regulations commence; and repeal the previous 2016 regulations. The regulations prescribe several Australian and international bodies to which protected RBA information or documents may be disclosed, including: Relevant Commonwealth government departments Australian Bureau of Statistics Australian Competition and Consumer Commission Australian Office of Financial Management Bank for International Settlements Basel Committee on Banking Supervision Committee on Payments and Market Infrastructures Financial Stability Board International Monetary Fund New Zealand Treasury The new regulations come into effect on October 1, 2026 and replace the Reserve Bank Regulations 2016.

AUSTRAC has published a sample checklist designed to help entities manage risks associated with outsourcing anti-money laundering and counter-terrorism financing (AML/CTF) functions. The checklist includes suggested good practices and recommendations to support compliance with Australia's AML/CTF obligations when engaging external service providers. The checklist addresses potential risks that arise when organisations outsource AML/CTF responsibilities to third parties. Before appointing a provider, businesses should: Assess the compliance, operational and information-sharing risks created by outsourcing and confirm that they fall within the business’s risk appetite. Conduct due diligence on the provider’s AML/CTF expertise, qualifications, resources and knowledge of the relevant industry. Verify the provider’s claims through demonstrations, documentation, references or testimonials. Identify legal restrictions on sharing customer or AML/CTF information and establish controls against unauthorised disclosure. Consider obtaining legal advice. Enter into a legally binding written agreement specifying the services, performance standards and oversight arrangements. Include mechanisms for monitoring the provider and responding proportionately to contractual breaches. Document these arrangements in the business’s AML/CTF program. After appointing a provider the business should maintain active, senior-management-led oversight. Responsibilities for managing AML/CTF compliance risk and money-laundering and terrorism-financing risk should be clearly allocated. AUSTRAC identifies several warning signs, including providers that: Lack knowledge of the Australian AML/CTF framework or the customer’s industry. Cannot explain how their service works, integrates with existing systems or supports specific AML/CTF obligations. Cannot explain the limitations of their product. Lack sufficient expertise or resources. Cannot provide demonstrations or relevant references. Do not understand legal restrictions on information sharing. Provide generic, template-based products rather than tailored solutions. Have not designed their service for Australian businesses. Do not offer implementation support, training or updates. Resist ongoing monitoring and oversight.

On July 13 2026, the Australian Securities and Investments Commission (ASIC) issued its 2025-26 Cost Recovery Implementation Statement (CRIS), which outlines how ASIC will recover regulatory costs from industry under the industry funding model. For the 2025-26 financial year, ASIC's total estimated recoverable costs are A$400.5 million, representing a 19 percent increase from the A$337.6 million recovered in FY2024-25. The increase reflects additional funding for ASIC's regulatory, supervision and enforcement work, along with the timing of expenditure. The CRIS provides estimated regulatory costs and levies for each of ASIC's 52 regulated subsectors to help entities plan and budget for levies and fees to be charged. The statement's figures are a guide only, with final levies to be published in December 2026 and invoiced between January and March 2027. ASIC has also simplified its CRIS webpages to make key information easier to locate and interpret. Under Australia's industry funding model, entities regulated by ASIC receive an annual invoice for ASIC's regulatory services. The levies entities pay reflect ASIC's costs of regulating the subsectors they operate in. This model ensures that costs of regulatory activities are borne by the entities ASIC regulates, rather than Australian taxpayers. ASIC details how its costs will be recovered from each regulated subsector through industry funding levies and via fees for service each year. Entities should use the estimated levies to plan and budget accordingly.

On July 9, 2026, the Federal Financial Institutions Examination Council's (FFIEC) Task Force on Surveillance Systems announced several updates to the Uniform Bank Performance Report (UBPR). The revisions affect UBPR presentation only and do not alter any underlying ratios, numbers, or bulk download data. Key changes include: UBPR Presentation Titles: The financial institution regulatory agencies, under the direction of the FFIEC Task Force on Surveillance Systems, identified inconsistencies in UBPR line item titles on the asset quality pages (7, 7A, 7B, 8, and 8A) of the UBPR. To improve clarity and consistency, titles derived from identical loan Call Report concepts will be aligned accordingly. Liquidity Page 10 : An additional wholesale funding ratio, defined as Wholesale Funding + Public Funds to Total Assets (new ratio), will be incorporated into the UBPR. This metric will include deposits from states and political subdivisions held in domestic offices within the numerator. In addition, several ratios on this page will be realigned. These updates will take effect on or around August 10, 2026. The new ratio will be populated only for five quarters until September 2026 when 21 periods of data will be made available.

On July 13, 2026, the US Office of Foreign Assets Control (OFAC) issued sanctions targeting both cyber-related malware providers and Cuban entities. Specifically, OFAC added two individuals to its Specially Designated Nationals (SDN) list for illiciy cyber-related activities under its cyber sanctions program: Dmytro Rashevskyi, a Ukrainian national, and Yevgeniy Vladimirovich Silayev, a Belarusian national. OFAC additionally designated First VPN Service, a Ukrainian computer programming entity, for providing infrastructure supporting ransomware operations. Separately, OFAC designated ten Cuban entities under Executive Order 14404 , including government ministries, state-owned enterprises and civil society organisations. OFAC also issued a Cuba-related frequently asked question (FAQ) document to provide guidance on compliance with its Cuban sanctions program: FAQ 1262 .

On July 13, 2026, the Australian Securities and Investments Commission (ASIC) issued an infringement notice requiring Deutsche Bank Aktiengesellschaft to pay an A$2 million penalty for systemic failures in reporting over-the-counter (OTC) derivative transactions. Between October 21, 2024 and August 15, 2025, Deutsche Bank misreported more than 260,000 OTC derivative transactions, comprising 20,483 outstanding transactions and 244,091 terminated or matured transactions across 208 separate business days. The breaches involved foreign exchange and commodities OTC transactions and related to inaccurate reporting of mandatory 'direction' fields data under the ASIC Derivative Transaction Rules (Reporting) 2024 (ASIC Rules). Direction fields indicate whether a reporting entity acts as the effective buyer or seller of a transaction at a specified price. ASIC determined that Deutsche Bank's reporting failures were systemic and reflected deficiencies in the bank's internal reporting framework. The regulator found that Deutsche Bank failed to take all reasonable steps to ensure reported information remained complete, accurate and current, as required under rule 2.2.6 of the ASIC Rules. Accurate derivative transaction reporting is critical for regulators to monitor systemic risk, detect market abuse and enhance financial market oversight. Deutsche Bank cooperated with ASIC's investigation and is implementing measures to prevent further reporting errors. Compliance with the infringement notice does not constitute an admission of guilt or liability.

On July 13, 2026, the US Office of the Comptroller of the Currency (OCC), the US Federal Deposit Insurance Corporation (FDIC) and the US National Credit Union Administration (NCUA) jointly issued guidance to supervised financial institutions regarding credit risk management for borrowers not legally authorized to work in the US. The guidance explains that lending to individuals without work authorization presents elevated credit risk due to greater uncertainty surrounding a borrower's ability to generate income, maintain employment and remain financially stable, as well as advising financial institutions to identify, measure, monitor and control these risks through safe and sound underwriting practices that assess a borrower's willingness and capacity to repay according to the terms of the credit obligation. Additionally, the guidance directs financial institutions to consider a policy statement of the US Consumer Financial Protection Bureau (CFPB), titled " Statement on Ability To Repay and Immigration Status ", which reminds creditors of their obligations under the Truth in Lending Act and the Equal Credit Opportunity Act as they relate to non-work-authorized borrowers. The guidance was issued in accordance with Executive Order 14406 , which addresses risks to the financial system posed by the extension of credit or financial services to the inadmissible and removable population. According to the regulators , financial institutions should review their current lending policies and underwriting procedures to ensure compliance with supervisory expectations regarding credit risk assessment for non-work-authorized borrowers.

The Monetary Authority of Singapore (MAS) has issued an information paper detailing the AML/CFT supervisory expectations for digital payment token service providers. The issued information paper contains: Provisions prescribing a formalised approach to identify and assess money laundering and terrorism financing (ML/TF) risks before offering new products or listing new digital payment tokens (DPTs). Specific rules mandating enhanced customer due diligence (ECDD) measures for politically exposed persons (PEPs) and higher risk customers, requiring senior management approval and the establishment of the customer's source of wealth (SOW) and source of funds (SOF). Regulations outlining value transfer requirements to implement the Financial Action Task Force (FATF) travel rule, which require the secure transmission of originator and beneficiary information, alongside enhanced risk mitigation measures for transfers involving unhosted wallets. Administrative measures detailing the necessity for robust ongoing monitoring of both fiat and digital payment token (DPT) transactions, paired with comprehensive screening controls to detect any nexus to sanctions or adverse information. Directives establishing the requirement for due diligence on partners and outsourced service providers, as well as the implementation of tailored training programmes to ensure staff possess adequate expertise in blockchain technology and associated risks. The MAS states that the information paper must be read in conjunction with Notice PSN02 Prevention of Money Laundering and Countering the Financing of Terrorism and its accompanying guidelines .

On July 10, 2026, Serbia's Securities and Exchange Commission (SEC) published the Rulebook on Tied Agents under the Law on the Capital Market. The rulebook establishes regulatory requirements and operational standards governing tied agents operating within Serbia's capital markets framework. Tied agents are individuals or entities authorised to act on behalf of investment firms, banks or other market participants in providing investment services and activities. An investment firm shall: Ensure that its tied agents are familiar with, understand and apply the investment firm's internal policies and procedures to ensure compliance with the Law on the Capital Market. Assess, at least annually, the need for additional training and professional development of its tied agents. Ensure that the internal control function assesses and reviews compliance with the requirements laid down in this rulebook and, where appropriate, recommends appropriate training and professional development for tied agents. Clearly define the responsibilities of tied agents, including a clear distinction between the provision of investment advice and the activities of promoting the services of the investment firm and soliciting clients. This rulebook shall enter into force on the eighth day following the date of its publication in the official gazette.

On July 10, 2026, the Dutch Data Protection Authority (AP), alongside the Dutch Authority for Consumers and Markets (ACM), the Dutch Financial Markets Authority (AFM), De Nederlandsche Bank (DNB) and the State Inspectorate for Digital Infrastructure (RDI) released a joint report titled "The Route to Digital Autonomy". The report finds that growing dependencies on a small number of information technology (IT) service providers and over-reliance on non-European service providers are risks to the continutity of digital services. The regulators make a number of recommendations to the government: Governments should assume a catalytic role by consolidating demand for new European digital services and acting as early adopters. Both public and private organisations should prioritise digital autonomy when procuring IT services, including requirements for open standards, interoperability and vendor switching capabilities. Businesses are encouraged to collaborate within sectors as early adopters of sector-specific IT services, with significant scope for such cooperation under competition rules. IT providers should strengthen European alternatives through enhanced collaboration. The report aligns with broader digital risk management initiatives, including the Digital Operational Resilience Act (DORA) and the new Cybersecurity Act implementing the Network and Information Systems Directive 2 (NIS2). Both frameworks emphasise managing supply chain risks and strengthening resilience in essential and important organisations. The regulators delivered the report to government and invite organisations to contact them with questions regarding the recommendations.

On July 10, 2026, Brazil's Secretariat of Prizes and Betting under the Ministry of Finance (SPA/MF) published new regulations concerning the advertising of gambling products. Under Interministerial Ordinance MF/SECOM/MJSP No. 73/2026, the following is outlined: Operators are not permitted to advertise exclusive links, promotional codes, or mechanisms that direct the user to operator channels without prior authorization. Operators are not permitted to advertise winning bets, including prizes in real currency. Operators are not permitted to advertise gambling that present it as a source of income, investment, solution to financial problems, or a means of recovering past losses, along with suggesting that gambling is a path to easy money, encourage excessive gambling, or calls for urgency to place bets. Operators are not permitted to present advertisements that mislead any members of the audience about the odds of winning. Operators are not permitted to advertise towards minors, must not include imagery or the participation of minors, and must not associate gambling with cultural activities of the children's and youth public, or that are broadcast in educational establishments and medical and psychological care facilities. Digital storefronts must restrict access to betting sites for accounts held by minors, social media operators must also block advertising for minors holding accounts on their platform. Advertisers must consult the authorized operators list before airing an advertisement from an operator, to see if they are authorized by the SPA/MF. Advertisers must keep the operator's identification and the authorization number clearly and accessibly visible on their interface. For registration, it is mandatory to obtain and store the operator's name or company name, CNPJ (Brazilian tax ID), and authorization number. Furthermore, the SPA/MF published Ordinance SPA/MF No. 1.964, which outlines the following: Operators must include in their advertisements this warning "Ministry of Finance warns: Gambling can cause addiction”, “Ministry of Finance warns: Gambling makes you lose money” or “Ministry of Finance warns: Gambling is not an investment”. Operators must ensure the warnings appear horizontally, in a clear and legible manner, with a minimum size equivalent to 10 percent of the length or size of the advertisement, proportional to the rest of the communication piece. Operators of sweepstakes, or contests carried out for advertising purposes must comply with this ordinance. Non-compliance with Interministerial Ordinance MF/SECOM/MJSP No. 73/2026 results in administrative proceedings against the liable party, and repeated infractions may result in the suspension or cancellation of the advertising license. Interministerial Ordinance MF/SECOM/MJSP No. 73/2026 comes into effect immediately . Ordinance SPA/MF No. 1.964 comes into effect on July 17, 2026 for the implementation of warnings, but the provision regarding sweepstakes comes into effect immediately .

On July 9, 2026, the US Federal Reserve Board (FRB) announced an enforcement order against TS Banking Group and TS Contrarian Bancshares to address unsafe or unsound practices. According to the FRB, the enforcement order is designed to ensure the companies maintain financial safety and soundness and serve as a source of strength for their subsidiary banks. As part of the enforcement order, the FRB is requiring the companies to address capital and liquidity concerns by agreeing to: Submit a consolidated capital plan to maintain sufficient capital. Provide regular cash flow projections for debt service and operating expenses. Halt dividend payments, share repurchases and new debt without prior regulatory approval. Additionally, the companies must also submit quarterly progress reports detailing their compliance.

On July 9, 2026, the Office of the Privacy Commissioner of Canada (OPC) published new guidance for reporting entities on submitting codes of practice under the Proceeds of Crime (Money Laundering) and Terrorist Financing Act (PCMLTFA) . According to the OPC press release , reporting entities under section 5 of the PCMLTFA (including banks and other financial institutions) may share personal information without individual knowledge or consent in certain circumstances to detect or deter money laundering, terrorist financing, and sanctions evasion. However, to share personal information, entities must establish a code of practice governing the information sharing and have the code approved by the OPC. The new guidance clarifies the information required to meet the regulatory requirements for the OPC's approval. The guidance details the following requirements for codes of practice: Scope and accountability: Codes must identify all participating entities and limit scope to information disclosed, collected, or used under section 11.01(b) of the PCMLTFA, which must be reasonable and proportionate to detecting money laundering, terrorist financing, or sanctions evasion. Each entity must demonstrate responsibility through policies, training, and record-keeping, including documenting decisions and internal audit procedures. Identifying purposes and limiting collection: Codes must specify purposes for sharing and how they relate to detecting money laundering, terrorist financing, or sanctions evasion, with mechanisms to ensure appropriateness. Collection must be limited to what is necessary, with retention periods outlined and contextual information assessed against documented thresholds. Safeguards, accuracy, and individual rights: Codes must include measures for accuracy, safeguards against unauthorized access, and breach reporting procedures. Individuals must be informed of the use of their information, given access upon request, and provided with complaint procedures, including the ability to file a complaint with the OPC. Amendments and resubmission: Changes to an approved code must be notified to the OPC, which will determine if the revisions require a new application. Codes must be resubmitted for approval every five years. Applicants must submit codes to the OPC and notify the Financial Transactions and Reports Analysis Centre of Canada on the same day. The OPC has 120 calendar days to make a decision, with a possible 15-day extension. The clock may be paused if additional information is requested. The OPC will review applications based on the criteria set out in section 160 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Regulations.

On July 10, 2026, the US Office of Foreign Assets Control (OFAC) issued Iran-related General License Y , which authorizes the wind down of transactions involving Smart Global Ltd., as well as updating its Specially Designated Nationals (SDN) list with new Iran-related designations. Specifically, OFAC added eight individuals to the SDN list, targeting key financiers and operatives linked to Iran's shadow exchange network and the Islamic Revolutionary Guard Corps (IRGC). The designations were made pursuant to Executive Order 13224 . They block all US-based property of these targets and generally prohibit US individuals and entities from engaging in transactions with them, unless expressly authorized by OFAC.

On July 9, 2026, the Central Bank of Brazil (BCB) published Normative Instruction No. 760 , which releases version 9.0 of the Manual of Customer Experience in Open Finance. Version 9.0 introduces significant updates to customer experience requirements for participating institutions in Brazil's open finance ecosystem . Key amendments include enhanced guidelines for payment transaction initiation journeys without redirection, specifically addressing successive payment configurations for Automatic Pix and recurring scheduling. The manual now incorporates provisions for an optimised payment transaction initiation service journey that combines data sharing with payment services, and introduces requirements for credit portability service sharing journeys. Additional updates clarify mandatory client notifications regarding management environments during data-sharing completion stages and payment service initiation. The manual establishes four core principles for customer experience: security and privacy, agility, convenience and control and transparency and clarity, while also mandating that institutions provide clear, objective information throughout all sharing stages and establish consent management environments enabling customers to consult, modify and revoke consents.

On July 9, 2026, the Central Bank of Brazil (BCB) issued Normative Instruction No. 759 , which publishes version 8.0 of the Manual of Data and Services Scope for Open Finance. The primary change in version 8.0 involves the inclusion of data and scope specifications for the credit portability service, a new feature within Brazil's open finance framework . Credit portability enables customers to transfer credit operations from their original creditor institution to a proposing institution offering more advantageous terms, subject to prior customer consent and data sharing. The manual specifies minimum data requirements for credit portability, including customer identification, proposing institution details, original creditor institution information and characteristics of both the existing and proposed credit operations. The manual also maintains mandatory compliance for all participating open finance institutions, as well as establishing technical requirements for implementing data sharing and payment initiation services. It incorporates specifications for optimised payment transaction initiation journeys with data sharing and clarifies requirements for Pix instant payment arrangements.

On July 9, 2026, the Central Bank of Brazil (BCB) published Normative Instruction No. 761 , which provides guidance to BCB-authorised financial institutions on implementing enhanced due diligence measures for operations and business relationships involving clients, correspondent financial institutions and partners located in countries and territories with strategic deficiencies in implementing Financial Action Task Force (FATF) recommendations. The guidance serves as a supplement to Circular No. 3,978 , which previously established anti-money laundering and counter-terrorism financing (AML/CTF) policies, procedures and internal controls for BCB-authorised institutions. The guidance specifies minimum risk mitigation measures that institutions must adopt when engaging with high-risk jurisdictions identified by the FATF. These measures include obtaining, verifying and validating additional information about the qualifications of clients and partners; conducting supplementary analysis of the economic or legal basis for operations and business relationships; implementing enhanced monitoring of transactions; increasing the frequency of updating customer information; and maintaining detailed documentation of analyses, conclusions and decisions. For correspondent financial institutions and partners, the guidance directs these institutions to evaluate the viability of initiating or continuing business relationships when unacceptable or non-mitigable risks are identified, with similar procedures applying to clients, though with adapted requirements.

On July 7, 2026, the Peruvian Superintendency of Banking and Insurance (SBS) announced a proposed regulation to strengthen credit risk management in Peru's cooperative system. The proposed regulation addresses the administration of over-indebtedness risk among retail member-borrowers of savings and credit cooperatives (Coopacs), as well as establishing a normative framework to promote responsible member incorporation into the cooperative system and healthy growth of credit placements, with repayment capacity assessment as the central criterion. The proposed regulation also assigns specific responsibilities to the Board of Administration and General Management, and defines functions for the Risk Committee, Risk Unit and Internal Audit Unit. Additionally, the proposed regulation proposes a management reporting tool for cooperatives to use in measuring, monitoring and tracking over-indebtedness risk among retail member-borrowers.

On July 10, 2026, the US Financial Industry Regulatory Authority (FINRA) issued requested comment on a proposed rule to overhaul Rule 2210 , the rule governing broker-dealers' communications with the public. The proposed rule would eliminate the current requirement that a registered principal approve most retail communications before first use. In its place, member firms would adopt written, risk-based procedures to determine which retail communications require pre-use principal approval, a standard modeled on the one already used for institutional communications. Equity and debt research reports would remain subject to mandatory pre-use principal review. According to FINRA, the changes are meant to address interpretive challenges tied to newer technology: the existing distinction between "static" and "interactive" social media content has become hard to apply as platforms grow more interactive, and it stated risk from financial influencers exists regardless of that distinction. On artificial intelligence (AI), FINRA stated members remain fully responsible for communications regardless of whether they are generated by a person or an AI tool, and that vetted, tested and monitored AI-based review tools may be used as part of a firm's supervisory system. The proposed rule would also adjust two filing-timeline requirements: new member firms currently must file retail communications for review starting from the effective date of their FINRA membership. The proposed rule would instead start the one-year filing-review window from the date of the firm's first filing. It would additionally replace detailed disclosure requirements for communications referencing past specific investment recommendations with a general fair-and-balanced standard. Interested parties may comment on the proposed rule until September 11, 2026 at this link .

On July 10, 2026, the US Office of Foreign Assets Control (OFAC) issued Democratic Republic of the Congo (DRC)-related General License 2 , which authorizes specific transactions involving the DRC that would otherwise be prohibited under OFAC's sanctions regime. The general license permits dealings in agricultural commodities, medicine and medical devices, as well as replacement parts, components, software updates and clinical trial activities. The general license is applicable to all individuals and entities subject to US jurisdiction seeking to conduct the specified transactions with the DRC. Individuals and entities engaging in transactions under the general license must ensure compliance with all terms and conditions specified under it.

On June 15, 2026, the Alaska Division of Banking and Securities (DBS) issued an enforcement order against Signature Lending LLC. The order imposes a $2,500 civil penalty following the company's violations of the Alaska Secure and Fair Enforcement for Mortgage Licensing (SAFE) Act. Specifically, the DBS determined that Signature Lending LLC conducted mortgage lending activities in Alaska without holding a valid state broker/lender license between 2023 and 2024, thereby violating multiple provisions of the SAFE Act, including requirements for licensure, sponsorship of mortgage loan originators and supervision of personnel. The company was also found to have violated regulations prohibiting false or misleading statements in mortgage loan commitment or pre-qualification letters. The $2,500 civil penalty comprises $1,000 for unlicensed activities and $1,500 for failure to supervise.

On July 9, 2026, the Australian Securities and Investments Commission (ASIC) cancelled the Australian financial services (AFS) licence of contracts for difference (CFD) issuer Trive Financial Services Australia Pty Ltd (Trive), effective immediately. ASIC cancelled the licence because Trive ceased carrying on a financial services business in Australia. Under section 915B(3)(a) of the Corporations Act 2001 , ASIC may suspend or cancel an AFS licence when a body corporate stops conducting its licensed financial services business. The cancellation has been recorded on ASIC's Professional Registers. Trive has held an AFS licence since July 2012. Trive was one of 52 licensed CFD issuers assessed by ASIC during a whole of industry review of the CFD sector. Following ASIC's identification of serious deficiencies in Trive's processes, the company agreed to cease onboarding new clients in April 2025. ASIC's CFD sector review, announced in January 2026, resulted in the return of nearly A$40 million to more than 38,000 retail investors and drove substantial compliance improvements across Australia's CFD sector, including enhancements to target market determinations, customer onboarding processes, reporting compliance, and monitoring of customer trading outcomes. Trive may apply to the Administrative Review Tribunal for a review of ASIC's decision to cancel its licence. CFDs are high-risk products that allow investors to speculate on price movements of assets such as shares, currencies, or commodities without owning them.

On July 7, 2026, President Kassym-Jomart Tokayev signed the Decree "On Measures to Stimulate and Develop the Digital Asset Industry in the Republic of Kazakhstan." The Astana International Financial Centre (AIFC), National Bank of Kazakhstan, Ministry of Artificial Intelligence and Digital Development, and relevant government authorities jointly developed the decree to create a favourable legal and economic environment for Kazakhstan's digital asset sector. The decree aims to enhance investment attractiveness, strengthen protections for market participants, and expand opportunities for participants in Kazakhstan's crypto industry. Renat Bekturov, AIFC Governor, said the decree reflects President Tokayev's emphasis on applying emerging technologies to Kazakhstan's economy and represents a new stage in the digital asset market's evolution. Key initiatives include recognising digital assets and tokenised securities issued under AIFC jurisdiction throughout Kazakhstan, creating a level playing field for issuers. The decree permits stablecoins issued by AIFC-licensed issuers for cross-border settlements related to export and import transactions by non-residents. A new mechanism allows restriction of individual client accounts rather than restricting bank accounts of digital asset service providers. The decree also introduces tax incentives to encourage transferring digital assets from foreign platforms to regulated Kazakhstani platforms and establishes a voluntary disclosure mechanism for previously acquired or mined digital assets transferred to regulated infrastructure. These measures aim to formalise the industry, consolidate users within regulated environments, and enhance client protection through mandatory standards for asset custody, cybersecurity, and risk management. The AIFC will actively participate in implementing the decree in cooperation with government authorities to support sustainable development of Kazakhstan's digital asset industry.

The State Bank of Vietnam (SBV) has issued Circular No. 31/2026/TT-NHNN regarding the financial leasing activities of general finance companies and financial leasing companies. The issued circular contains: Provisions prescribing the scope of eligible financial leasing assets, expanding them to include transport vehicles (limited to domestic maritime transport ships) and property rights such as software, exploitation rights, intellectual property, and data. Specific rules mandating an increase in the threshold for small value financial leases, raising the limit from VND 100m (US$3,937) to a maximum of VND 400m (US$15,748). Regulations outlining a new framework for electronic financial leasing, dedicating a specific chapter to the approval steps and officially removing the previous transaction limit of VND 500m (US$19,685) for electronic approvals. Administrative measures detailing the reporting requirements for a lessee's credit balance, increasing the threshold that triggers the obligation to provide related person information to the lessor from 0.5 percent to 1 percent or more of the lessor's equity. The circular takes effect on August 15,2026.

The Securities and Futures Commission (SFC) of Hong Kong has issued a circular to licensed corporations and SFC-licensed virtual asset service providers (VASPs) regarding the implementation of robust authentication methods and adequate surveillance measures. The issued circular contains: Directives requiring internet brokers and SFC-licensed VASPs to adopt robust authentication methods for customer account logins and device binding to protect against phishing attacks. Specific rules mandating the implementation of effective surveillance and monitoring measures to identify suspicious transactions in customer accounts, including trade instructions and the withdrawal of funds or virtual assets. Provisions outlining rapid response and reporting procedures for hacking incidents, requiring firms to contain unauthorized activities, protect customer assets, notify affected customers, and report incidents to the SFC. Regulations prescribing that one time passwords (OTPs) transmitted via email and SMS are not considered phishing resistant authentication solutions and must no longer be used for customer logins or device binding processes. Administrative measures detailing acceptable robust authentication alternatives, explicitly recommending the use of passkeys based on public key cryptography and the implementation of bound devices that are linked to customer accounts through rigorous verification methods. The circular takes immediate effect and the stated measures must be implemented by July 8, 2027.

The Monetary Authority of Singapore (MAS) has issued a consultation paper on its proposed amendments to the code on collective investment schemes to facilitate retail fund product innovation. The consultation paper contains: Regulations prescribing the introduction of an alternative funds appendix to the code on collective investment schemes (CIS code), which would allow new fund types to deviate from existing investment requirements while being subject to alternative safeguards. Specific rules mandating that funds authorised under this new appendix must carry a clear and prominent statement in their prospectuses, product highlights sheets, and marketing materials to ensure investors can distinguish them from traditional funds. Provisions outlining product-level safeguards for futures-based single-commodity funds, requiring them to track a well-recognised futures price index, maintain at least 90 percent of their net asset value (NAV) in permitted commodities (gold, silver, platinum, crude oil, and iron ore), and limit global derivative exposure to 100 percent of the NAV. Administrative measures detailing updates for single-country government bond funds, proposing the removal of previous credit rating requirements provided the public debt instruments are part of a well-recognised international index and the fund invests in at least six different issuances, with no single issuance exceeding 30 percent of the NAV. Directives establishing that the MAS will also recognise foreign funds that are comparable to the new fund products authorised under the alternative funds appendix to facilitate the cross-listing of a wider range of funds. Feedback may be submitted via this FormSG link by August 10, 2026.

On July 8, 2026, Washington's Attorney General announced a settlement with Block Inc., the company behind the peer-to-peer payments application Cash App. The first settlement, filed in King County Superior Court, resolves the Attorney General's Office (AGO) investigation into how Block handled fraudulently transferred unemployment deposits into Cash App accounts from Washington's Employment Security Department during the COVID-19 pandemic. Block agreed to pay $20m to settle this matter. The AGO's investigation into pandemic-era unemployment benefits fraud began in August 2020, following Washington's loss of more than $648m from identity theft and unemployment benefits fraud. Between March and August 2020, at least $22m in unemployment benefits from the Employment Security Department were fraudulently transferred through Cash App accounts. The AGO alleged Block's actions violated Washington's Consumer Protection Act by failing to maintain adequate anti-fraud controls.

On July 9, 2026, the European Commission and the High Representative of the Union for Foreign Affairs and Security Policy proposed a new European Union sanctions regime targeting migrant smuggling, human trafficking and other serious forms of organised crime, including trafficking in firearms, illicit drugs and money laundering. The proposal aims to disrupt the business model of criminal networks by restricting their movements and cutting off their profits. Organised criminals destabilise societies, undermine the rule of law and democracy, and weaken economic stability and security. The proposed sanctions regime targets illicit activities originating outside the European Union which pose a serious threat to the Union's values, security and international security. The proposed restrictive measures include asset freezes and prohibitions on making funds or other economic resources available to listed persons or entities, and travel bans preventing entry into or transit through European Union member states by listed persons. The proposals will now be presented to the Council and require adoption by member states by unanimity.

On July 9, 2026, the European Parliament approved proceeding to interinstitutional negotiations with the Council on a digital euro proposal. The plenary backed the proposal with 416 votes in favour, 169 against and 22 abstentions, following a challenge to the Economic and Monetary Affairs Committee's June 23, 2026 decision to open talks. The Parliament also approved negotiations on non-euro payment service providers by a show of hands, and a third file concerning the legal tender of euro banknotes and coins proceeded without contest. Parliament's negotiating position emphasises privacy safeguards, with transactions verified without exposing personal data, processed only to the extent strictly necessary for system operation. Most businesses would be required to accept the digital euro, with exceptions for self-employed individuals and small and micro enterprises that do not accept other digital payments. Basic services, including account opening, fund management and access to at least one payment instrument would be provided free of charge. To protect the financial system, individual holdings of digital euros would be capped. Banks and payment service providers from non-euro EU member states would be permitted to distribute the digital euro. Euro area countries must maintain cash accessibility, with businesses prohibited from banning cash and member states required to monitor cash availability regularly, with particular attention to vulnerable groups, including the elderly, low-income individuals and those without access to traditional banking systems.

On July 6, 2026, the Central Bank of Russia (CBR) published an information letter on the restructuring of borrowers' debt. Key points include: If a borrower submits an application to a lender during the third quarter of 2026 requesting loan restructuring, the CBR recommends that loan providers approve such an application. A lender is entitled to assess the borrower's financial condition as no worse than average, provided that: The development plan submitted by the borrower to the lender as part of the restructuring procedure is based on the projected macroeconomic indicators set out in the CBR's medium-term forecast. The business plan provides for the following financial performance targets, which the borrower must meet during the relevant period. The development plan submitted by the borrower to the lender as part of the restructuring procedure is based on the projected macroeconomic indicators set out in the CBR's medium-term forecast. The business plan provides for the following financial performance targets, which the borrower must meet during the relevant period. A lender, in exercising its professional judgement, has the right to decide (an aggregate decision regarding the entire portfolio of loans) not to take the loan restructuring factor into account if the total duration of the borrower’s delinquencies on principal and/or interest over the past 180 calendar days as of the date of the credit risk assessment does not exceed 30 calendar days.

On July 9, 2026, Sweden's government published a report titled "Measures to Combat Over-Indebtedness". The report proposes measures to reduce over-indebtedness problems, primarily by reducing the number of individuals experiencing long-term debt difficulties. The investigation examined potential amendments to the Debt Relief Act (skuldsaneringslagen) and proposed three key changes: a revised payment allocation system for consumer claims; rules establishing absolute prescription periods for consumer claims; and a time-delay regulation for recently concluded consumer credit agreements. The report recommends several modifications to the debt relief procedure and proposes introducing a special allocation system for consumer claims that have matured for payment. The proposed changes aim to enable more long-term debtors to exit their debt situations. The revised allocation system is expected to prevent debtors' payment problems from developing into prolonged over-indebtedness. These measures represent a comprehensive approach to addressing structural issues within Sweden's debt relief framework and consumer credit market.

On July 8, 2026, the National Bank of Ukraine (NBU) adopted Resolution No. 78, which amends the Rules of Banking Operations in connection with the introduction of martial law in Ukraine. During the period of martial law and for 30 calendar days following its termination or repeal, banks have the right to decide to temporarily suspend the operations of separate divisions located in territories included in the List (provided that no date has been set for the cessation of hostilities, the end of hostilities, the end of temporary occupation with respect to the relevant settlement), without regard to the requirements of paragraph 442 of Chapter 54 of Section VIII of the Regulations on Bank Licensing regarding the duration of the temporary suspension of operations of separate divisions. This resolution shall enter into force on the day following the date of its official publication.

On July 8, 2026, the European Union Anti-Money Laundering Authority (AMLA) introduced a common enforcement approach for anti-money laundering and counter-terrorist-financing (AML/CTF) breaches across all EU member states. The new standards represent the first time EU supervisors will apply a harmonised, consistent methodology to enforce AML/CTF rule violations, ensuring that identical breaches in identical circumstances produce the same enforcement outcome regardless of jurisdiction. Previously, the same breach could result in significantly different enforcement responses depending on the supervising authority or country involved. AMLA's standards advance supervisory convergence by establishing a common, step-by-step enforcement method that all supervisors must follow. Under this approach, supervisors first assess breach gravity using shared indicators, including duration, repetition and impact. Breaches are then classified into one of four gravity levels, with common criteria guiding supervisors toward appropriate enforcement outcomes. The standards preserve proportionality, effectiveness and dissuasiveness while eliminating inconsistencies across jurisdictions. The standards apply to all sectors covered by AML rules, encompassing both financial and non-financial institutions. Once adopted by the European Commission, the standards will become legally binding regulatory technical standards (RTS) under Article 53(10) of the Anti-Money Laundering Directive (AMLD) and will apply directly across all EU member states without requiring transposition into national law.

On July 9, 2026, the European Securities and Markets Authority (ESMA) published a public statement designating three benchmarks administered by FTSE International Limited as significant under the Benchmark Regulation (BMR). The designation followed a notification from FTSE EU SAS, the administrator, confirming that the benchmarks had reached the €50bn threshold specified in Article 24(1) of the BMR. ESMA designated the following benchmarks as significant: WMR 4pm Closing Spot Rates; FTSE MIB Index; and FTSE All-World Index. This classification triggers enhanced regulatory requirements and oversight obligations for benchmark administrators. The designation reflects the systemic importance of these benchmarks within EU financial markets and ensures they receive appropriate regulatory scrutiny to protect market integrity and investor protection. ESMA will update its official register to include the relevant characteristics of these three benchmarks as significant benchmarks pursuant to Article 24(2) of the BMR. This update will ensure market participants and competent authorities have access to current information regarding significant benchmarks operating within the EU financial system.

On July 9, 2026, the European Banking Authority (EBA) published the final technical package for version 4.3 of its reporting framework. The package implements new reporting requirements for third-country branches (TCBs) under the Capital Requirements Directive (CRD) and supports a risk assessment data collection exercise by the Anti-Money Laundering Authority (AMLA). The final technical package provides standard specifications, including validation rules, the data point model (DPM) and XBRL taxonomies to support two key reporting obligations. First, it implements the final draft Implementing Technical Standards (ITS) on the supervisory reporting of TCBs in accordance with Article 48l(1) of the CRD, with a first reference date of March 31, 2027. Second, it introduces DPM and taxonomy components supporting AMLA's risk assessment reporting methodology to identify obliged entities falling under AMLA's direct supervision, with a first reference date of December 31, 2026. The EBA also published a new Glossary Usage Exploration file accompanying the reporting framework. This file provides a structured, user-friendly view of glossary content and its use across the reporting framework, allowing users to explore concepts, definitions and their relationships within the DPM. The file aims to facilitate interpretation of reporting requirements, support impact assessments and contribute to a consistent understanding of the semantic model underpinning the EBA reporting framework. The final version incorporates feedback received from stakeholders, including industry representatives, following review of the draft package published on April 17, 2026. The EBA may issue a targeted update at the end of September 2026 should any critical clarifications or adjustments be required following early implementation feedback.