Published

On July 9, 2026, the Icelandic government launched a public consultation on temporary adjustments to new rules on capital requirements for credit institutions due to market risk. The consultation concerns plans to implement EEA regulations, including a temporary adjustment to the new capital requirements rules until the end of 2029. The temporary measure aims to prevent Icelandic and European Economic Area (EEA) credit institutions from facing higher capital requirements than competitors outside the region, thereby undermining their competitive position. The proposed regulation does not delay the implementation of new market risk rules; instead, it provides a transitional adjustment to capital requirements, maintaining comparability with existing rules through the end of 2029. The proposed regulation will be implemented by amending Article 1(c) of the Financial Undertakings Act, with an anticipated effective date of January 1, 2027, aligning implementation with the EU. The consultation period ends on August 13, 2026. Responses should be submitted to the Financial Market Authority office via email to gunnlaugur.helgason@fjr.is .

On July 9, 2026, the Bank of Italy published its "ICT Major Incident Surveillance Signalling Framework - Horizontal Analysis 2025", which synthesises key findings from notifications of serious information and communication technology (ICT) incidents reported to the institution during 2025 under the Digital Operational Resilience Act (DORA). The report reveals a significant increase in ICT incidents compared with the previous year. The majority of incidents were operational in nature, with approximately one quarter relating to cybersecurity. The analysis highlights substantial involvement of external service providers in reported incidents. The findings underscore the importance of the new serious ICT incident reporting framework introduced by DORA in strengthening the Bank of Italy's capacity to analyse and monitor cyber risks across the financial sector. The growing number of incidents and the material involvement of ICT service providers reinforce the necessity for financial intermediaries to establish robust governance and control frameworks for ICT risk management. Intermediaries must effectively manage third-party risk and ensure full compliance with DORA requirements. The report confirms that the standardised incident notification scheme established under DORA has proven instrumental in enhancing supervisory oversight and risk monitoring capabilities within Italy's financial sector.

On July 10, 2026, the Financial Conduct Authority (FCA) published findings from its review into firms' approaches to products and services under the Consumer Duty. The review examined firms across banking, insurance, payments and e-money, asset management, consumer investments and consumer finance to identify good practice and areas for improvement in meeting the requirements of the Consumer Duty. The FCA's review focused on three key areas: Product and service design and target market identification. Monitoring and review of products over their lifecycle. Distribution and third-party arrangements. The findings highlight that many firms have developed effective practices, including mapping customer needs to product design, conducting customer impact assessments and adapting customer journeys for different segments, such as implementing Web Content Accessibility Guidelines for digital content and introducing voice control options for customers with accessibility needs. Several firms have established "inclusive design panels" drawing on customer and charitable organisation experiences to shape product development. However, the FCA identified recurring gaps in compliance. Some firms provided overly simplistic target market definitions without adequately explaining how these align with product risk profiles. Many firms relied heavily on complaints data rather than developing broader management information to monitor customer outcomes. Additionally, some firms failed to validate the impact of interventions introduced to improve customer outcomes. The FCA emphasised that although smaller firms may apply the Consumer Duty proportionately based on their resources and customer base, all firms should develop outcome-focused management information and take appropriate action when potential harms emerge. The FCA also called on firms to consider the FCA's consultation CP26/23 on the scope and proportionality of the duty before implementing major process changes.

On July 10, 2026, the Bank of England, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) announced they will begin jointly overseeing the first critical third parties (CTPs) on July 13, 2026, following designation by HM Treasury (HMT). HMT has designated four global cloud services and technology providers as CTPs: Amazon Web Services EMEA SARL; Google Cloud EMEA Limited; Microsoft Ireland Operations Ltd; and Oracle Corporation UK Limited. CTPs are technology and other service providers whose services underpin the UK financial system. As many firms rely on these services, disruption or failure could affect multiple firms or markets simultaneously, potentially affecting UK financial stability and services used by millions of consumers and businesses. The three regulators will jointly oversee these CTPs under a new, proportionate regime focused on the resilience of critical services provided to the UK financial sector. The regime complements, but does not replace, existing outsourcing and operational resilience rules for regulated firms, which remain responsible for managing their own third-party arrangements including due diligence, risk management and contingency planning. CTPs must identify and manage risks to their critical services effectively and maintain open, timely communication with regulators and reliant firms, particularly during major incidents. The Critical Third Parties (Designation) Regulations 2026 will come into effect on July 13, 2026. HMT retains responsibility for designating and de-designating CTPs, while the regulators will periodically review whether CTPs continue meeting designation criteria and make recommendations to HMT. The regulators will continue working closely with HMT, the financial services industry and designated CTPs as the regime is implemented. The regulators have signed a memorandum of understanding with EU regulators to support coordination and information sharing on CTP oversight.

On July 9, 2026, the South African Reserve Bank (SARB) announced that it had imposed administrative sanctions on Southeast Exchange Company South Africa (Pty) Ltd, an Authorised Dealer in Foreign Exchange with Limited Authority (ADLA), for multiple breaches of the Financial Intelligence Centre Act 38 of 2001 (FIC Act). The sanctions followed supervisory inspections that identified weaknesses in the firm's anti-money laundering and counter-terrorist financing (AML/CFT) control framework, which impaired its ability to conduct ongoing customer due diligence in accordance with its Risk Management and Compliance Programme (RMCP) and apply the risk-based approach required under the FIC Act. The SARB also found that the firm had failed to appoint an Anti-Money Laundering Compliance Officer and had not provided AML/CFT training to its staff. The total administrative penalty imposed amounts to ZAR600,000: R600,000 (approximately $36,730 USD).

On July 10, 2026, the Australian Prudential Regulation Authority (APRA) opened a consultation on a package of minor technical amendments to its prudential and reporting framework. The proposals affect 10 prudential standards, 15 reporting standards and two prudential practice guides, but APRA says they do not introduce new policy requirements or materially change existing obligations. Their purpose is to correct drafting issues, remove outdated references, clarify how existing rules should be applied and improve the quality of regulatory data. For authorised deposit-taking institutions, including banks, the package would: Clarify the leverage-ratio treatment of securitised exposures under APS 110 . Replace outdated references to “Tier 1” capital with Common Equity Tier 1, reflecting the removal of Additional Tier 1 capital. Clarify the capital treatment of trail commission assets and residual-value risks associated with leases. Increase the credit conversion factor for undrawn servicer cash advances under APS 120 from zero to 10 percent, correcting an omission from Australia’s Basel III implementation. Clarify when concessions granted to borrowers in financial difficulty constitute a restructured exposure, while allowing proportionate credit assessments for some short-term retail hardship cases. APRA is also proposing several reporting changes, including updates to superannuation reporting tables to prevent duplicate data, corrections to banking capital and interest-rate-risk reporting instructions, removal of a restriction requiring currencies to appear in the ISO 4217 list , and the remaking of several reporting standards that are due to sunset in 2027. Submissions are due by 21 August 2026. APRA expects to finalise the package in November 2026, with most amendments taking effect from 1 January 2027. Reporting standards approaching their statutory sunset dates will take effect when they are remade.

On July 9, 2026, the French Financial Markets Authority (AMF) published a summary of its anti-money laundering and combating the financing of terrorism (AML/CTF) inspections and related enforcement actions. The report covers the period from January 1, 2022 to December 31, 2025, and consolidates key findings from inspections, sanction decisions, administrative settlement agreements and follow-up correspondence issued during this timeframe. The summary focuses on AML/CTF compliance issues identified among asset management companies and financial investment advisors operating in France. It draws together the principal lessons learned from enforcement actions pursued by the AMF Enforcement Committee, including sanctions decisions and administrative settlements. The report also addresses compliance matters related to tax evasion and fraud prevention within the supervised sector. The report also details the shortcomings identified by the AMF’s inspection teams, which include: Incomplete and insufficiently precise AML/CTF procedures that are not adapted to the activities carried out. Risk maps that are insufficiently personalised, incomplete or that do not provide an operational link between the risks identified and the vigilance measures implemented. Shortcomings in the collection, storage, updating and traceability of information relating to clients, their beneficial owners, the origin of funds or politically exposed person status. A lack of regular and appropriate training for employees on AML/CTF obligations. Internal control systems that are insufficiently formalised or whose effectiveness has not been demonstrated. Breaches of TRACFIN or AMF reporting obligations. The report provides transparency into the AMF's supervisory priorities and enforcement outcomes in the AML/CTF domain.

On July 9, 2026, Portugal's government published Decree-Law No. 134/2026, which amends the legal framework governing retail investment product packages and insurance-based investment products established under Law No. 35/2018 of July 20, 2018. The decree-law replaces the prior approval regime for advertising retail investment product packages and insurance-based investment products with a prior notification regime to the competent authority. Under the new framework, the competent authority may object within ten business days of receiving the notification, which must be accompanied by the advertising message, material elements relating to the distribution channels and the key information document. The change excludes collective investment undertakings (OIC) that do not qualify as complex financial instruments. This modification aligns with Article 7(1) of Regulation (EU) 2019/1156 and maintains supervisory intervention powers before advertising dissemination while tailoring verification to product complexity and risk. The decree-law also grants the competent authority regulatory authority to extend the advance notification period for key information documents up to a maximum of five business days, maintaining a two-business-day default period based on supervisory needs. Advertisers must immediately cease dissemination if non-compliance is detected or circumstances arise affecting advertising conformity. The decree-law entered into force on July 9, 2026.

The Hungarian National Bank (MNB) has issued a management circular addressing the supervisory treatment of MNB-maintained bank accounts regarding the placement of funds received from payment transactions. The circular targets non-credit institution payment service providers, including payment institutions and electronic money institutions, that provide payment services in Hungary under the Act CCXXXVII of 2013  on Credit Institutions and financial enterprises . The MNB permits non-credit institution payment service providers to connect to the Real-Time Gross Settlement System (VIBER) as a designated payment system and provides account management services exclusively in connection with participation in designated payment systems. Effective July 15, 2026, the MNB's business terms specify that account management services for non-credit institution payment service providers are limited to payment accounts for this purpose only. Funds must be used solely for settling and executing the provider's own and clients' payment transactions within the payment system. The circular clarifies that placing customer funds on accounts maintained by the MNB does not comply with customer fund protection measures under the Payment Services Act. Non-credit institution payment service providers must comply with customer protection requirements by: Temporarily crediting funds received for electronic money issuance to their payment accounts while immediately implementing measures ensuring compliance. Holding funds received for payment services that are not transferred to another payment service provider or paid to beneficiaries until the end of the business day following receipt, after which they must implement measures ensuring compliance. The MNB expects compliance with these requirements from affected institutions without delay. The circular is not legally binding but expresses statutory requirements and recommended supervisory principles and methods.

On July 9, 2026, the Swiss Financial Market Supervisory Authority (FINMA) published FINMA Guidance 05/2026 on quantum computing addressing the opportunities and risks posed by quantum computers to Swiss financial institutions. FINMA conducted a survey of 60 Swiss financial institutions between November 2025 and January 2026 to assess their preparedness for quantum computing threats. The survey revealed that although institutions recognise the cyber risks posed by cryptographically relevant quantum computers, most lack a clear roadmap and sufficiently forward-looking planning for migration to quantum-safe encryption. FINMA determined that action is needed in the risk management processes of numerous institutions to continue meeting operational risk and resilience requirements. The guidance outlines measures for addressing cyber risks posed by cryptographically relevant quantum computers. These include: Establishing a clear strategy and roadmap for migrating to quantum-safe encryption. Conducting institution-specific risk analysis. Creating a cryptographic inventory. Protecting critical data against "harvest now, decrypt later" attacks. Involving external service providers in migration planning. Transitioning to crypto-agility. FINMA emphasises that these measures are intended to strengthen the Swiss financial centre's reputation and resilience, enabling institutions to reliably protect their business processes as powerful quantum computers become available. FINMA encourages early engagement with and mitigation of the risks posed, particularly given the complexity and time required for the migration to quantum-safe encryption technologies, the interdependencies between service providers and financial institutions, and the already very real risk of "harvest now, decrypt later" attacks.

On July 7, 2026, the European Parliament adopted its yearly report on competition policy, proposing significant amendments to strengthen enforcement against technology companies and promote European strategic autonomy. The report calls for tougher enforcement of the Digital Markets Act (DMA) through increased market investigations, interim measures, non-compliance cases and fines. To support this, MEPs propose introducing a DMA fee to secure stable enforcement resources. The Parliament urges the European Commission to use its ongoing cloud services market investigation to adjust DMA obligations and assess whether core platform services should expand to include artificial intelligence (AI) models, AI chatbots, virtual assistants, and connected television operating systems, effectively widening the DMA's scope. Regarding payments, MEPs call on the commission to conclude investigations into Visa and Mastercard fees without delay and suggest revisiting the Interchange Fee Regulation. They emphasise the digital euro as an opportunity to reduce reliance on non-EU card schemes. Additional proposals include establishing an EU-level market investigation tool to address structural competition issues, implementing binding procedural time limits for antitrust investigations, and ensuring fines exceed illicit gains.

On July 7, 2026, the European Data Protection Board (EDPB) published final guidelines on the processing of personal data through blockchain technologies. The guidelines provide clarity on how the General Data Protection Regulation (GDPR) applies to blockchain-based systems and distributed ledger technology (DLT) implementations. These guidelines provide a framework for organisations considering the use of blockchain technology, outlining key GDPR compliance considerations for planned processing activities. They provide an overview of the fundamental principles of blockchain technology, assessing the different possible architectures and their implications for the processing of personal data. Furthermore, they clarify that the roles and responsibilities of different actors in a blockchain-related processing need to be assessed during the design of that processing and what elements need to be considered in this respect. Depending on the purpose of processing for which blockchain technology is used, different categories of personal data may be processed. The guidelines highlight the need for data protection by design and by default, and adequate organisational and technical measures. They also provide examples of different techniques for data minimisation and for handling and storing personal data.

On July 7, 2026, the European Parliament adopted the Resolution of July 7, 2026 on Digital Assets - Challenges for the Competitiveness and Integrity of the European Union's (EU) Financial System. The resolution: Underlines that DLTs and asset tokenisation have the potential to support the objectives of the Savings and Investment Union by facilitating cross-border investment, reducing market fragmentation and enabling more efficient and inclusive capital market infrastructure across the EU. Emphasises that the emergence of new technologies in finance poses new challenges for the regulatory and supervisory framework, notes the diversity of digital assets and recognises that the associated risks and business potential differ from one category to another, affirms its commitment to the targeted revision of EU regulatory frameworks to develop robust, digital-asset-enabled EU capital markets and payment infrastructure, urges the Commission to assess the necessity and feasibility of regulating crypto-asset lending and borrowing, including staking, non-fungible tokens and decentralised finance, under MiCA. Underlines the potential innovation and connectivity capabilities of cryptographically secured distributed ledgers and similar technologies for financial services infrastructure, both within the EU and for the EU’s global role, emphasises that a predictable, innovation-friendly regulatory environment will be essential to ensure that investment and technological development remain within the EU and to foster competitiveness and trust in euro-denominated financial infrastructure.

On July 8, 2026, the Central Bank of Brazil (BCB) issued Normative Instruction BCB No. 757, establishing procedures for financial institutions to report information regarding foreign currency deposit accounts to the BCB. The instruction implements Article 80-A of BCB Resolution No. 277 , which regulates Brazil's foreign exchange market and the movement of Brazilian real and foreign currency values into and out of the country. The instruction applies to all institutions authorized to operate in Brazil's foreign exchange market that maintain foreign currency deposit accounts. These institutions must submit monthly reports using document code C214 (Totals Moved in Foreign Currency Accounts – file ACAM214) by the fifth day of each month, containing information on accounts with movement or balances during the previous month. The reports must be submitted through the File Transfer System (STA) in XML format, with validation conducted using XML Schema Definition (XSD). Required information includes customer identification, account holder classification, International Bank Account Number (IBAN) format identifiers, foreign currency denomination, reference month, and account value in the denomination currency. Each institution must designate an employee responsible for responding to inquiries about submitted information, registered in the BCB's Information System on Entities of Interest to the Central Bank (Unicad). A director responsible for foreign exchange operations must also be designated in accordance with BCB Resolution No. 277 . The instruction enters into force on October 1, 2026.

On July 8, 2026, the US Securities and Exchange Commission (SEC) issued a consultation on a proposed update for the future version of the US Generally Accepted Accounting Principles (GAAP) Financial Reporting Taxonomy. The proposed update relates to the Proposed Accounting Standards Update (ASU) on Fair Value Measurement (Topic 820) concerning investment companies with equity securities subject to contractual sale restrictions. The Financial Accounting Standards Board (FASB) developed the proposed taxonomy update to include reference modifications, new elements for ASU identification, and deprecation for guidance that is no longer applicable. The update aims to enhance the eXtensible Business Reporting Language (XBRL)-structured financial statements used in SEC filings. The proposed taxonomy update does not indicate SEC approval of any potential regulatory changes related to the Electronic Data Gathering, Analysis and Retrieval (EDGAR) Filer Manual. The taxonomy version for proposed updates will be determined based on the effective date of each final Accounting Standards Update. The SEC staff encourages filers, investors, analysts, software service providers, and other interested parties to review the proposed update to improve the process for creating and using XBRL-structured financial statements. Only annual compilations of the US GAAP Financial Reporting Taxonomy specified on the SEC's website may be used in SEC XBRL submissions. The public comment period on the proposed update ends on July 17, 2026. Interested parties should submit comments directly to the FASB.

On July 8, 2026, the National Bank of Ukraine (NBU) adopted amendments to the procedures for assessing the resilience of individual banks and the banking system. The NBU aligned the assessment process with a new framework for establishing enhanced prudential requirements for banks following Supervisory Review and Evaluation Process (SREP) outcomes. The NBU retained the three-stage assessment approach: Asset quality reviews (AQR) conducted by independent auditors for all banks. Extrapolation of AQR results across the banking system, where necessary. Stress testing for the largest banks under baseline and adverse macroeconomic scenarios. For banks assessed under only two stages, the NBU eliminated requirements to determine necessary capital adequacy ratios based on resilience assessment results. Instead, these results directly inform enhanced prudential requirements determined through SREP. For banks undergoing all three assessment stages, the NBU sets required capital adequacy ratios at the higher of two values: the necessary level determined from stress testing results, or the overall capital requirement (OCR) from SREP outcomes. The NBU optimised the assessment process by requiring banks to achieve necessary capital adequacy levels by the end of the year in which the assessment occurs and maintain them through the end of the following year. Banks must only develop and implement capitalisation or restructuring programmes if they fail to meet required levels by year-end or subsequently breach them. To align with European approaches, the updated procedures require determining necessary leverage ratio (LR) levels from resilience assessments, though implementation of this requirement has been deferred. This resolution comes into effect on July 9, 2026.

On July 2, 2026, the Ministry of Finance published the Draft Act Amending the Act on Prudential Supervision of Investment Firms. The two primary objectives include: The draft act transposes into Slovenian law the amendments introduced by Directive (EU) 2024/2994 to Directive (EU) 2019/2034 on the prudential supervision of investment firms. As part of the broader EMIR 3 legislative package, these amendments introduce requirements for managing concentration risk arising from investment firms' exposures to central counterparties (CCPs) and counterparty risk in centrally cleared derivative transactions. The draft act incorporates these requirements into the framework for internal management and risk control at brokerage firms and grants the Agency appropriate supervisory powers to oversee compliance. The draft act updates references to Slovenia's new Banking Act (ZBan-4), which replaced the previous banking law, and aligns references to European Union regulations with the current EU legal framework.

On July 8, 2026, the European Banking Authority (EBA) published a final report on the implementation of International Financial Reporting Standard 18 (IFRS 18) in the Financial Reporting (FINREP) framework under Article 430(7) of Regulation (EU) No. 575/2013. Key aspects of the proposals related to the implementation of IFRS 18 in FINREP are: Reshaping of the Statement of Profit or Loss (F 02.00) based on the business model of a retail and investment bank as a benchmark to ensure a standardised presentation. Maintenance of the current level of information within the ‘operating category’ of the Statement of Profit or Loss (F 02.00), in line with the expectation that most of the income and expenses of a retail bank will be included in the "operating performance". Introduction of a more aggregated representation of income and expenses that are not related to the institution’s main business activities within the investing and financing categories of the Statement of Profit or Loss (F 02.00). Maintenance of the current breakdown of income and expenses in templates F 16 and F 45, regardless of the institutions’ business models. The final report will be combined with the broader report on the draft Implementing Technical Standards (ITS) amending Commission Implementing Regulation (EU) 2024/3117, following the close of the public consultation on July 10, 2026. The consolidated ITS will then be submitted to the European Commission for adoption and is expected to apply from the end of September 2027. To support implementation, the EBA will publish the associated Data Point Model (DPM) and XBRL taxonomy for the revised IFRS 18 reporting templates by the end of July 2026, or at the latest by early September 2026.

On July 8, 2026, Italy officially published Legislative Decree 122 of June 10, 2026, implementing Articles 11, 12, 13, and 15 of Directive (EU) 2024/1640, the 6th Anti-Money Laundering Directive. The decree transposes key provisions of the directive into Italian law, establishing mechanisms to prevent the misuse of the financial system for money laundering and terrorist financing. Italy's legislative decree makes various amendments to Legislative Decree No. 231 of 21 November 2007 . The implementation addresses evolving risks in financial systems and strengthens preventative measures across member states through harmonised requirements for financial institutions and designated non-financial businesses and professions. Regulated entities should review the full text of the legislative decree to identify applicable obligations under the transposed articles and implement necessary procedural and operational changes to align with the updated AML/CTF framework. The decree enters into force on July 23, 2026.

On July 8, 2026, HM Treasury published "The Value of Resilience: Cyber Resilience in Financial Services", a comprehensive report examining the economic and financial value of operational resilience in the UK financial sector. The report consolidates new and existing evidence on how cyber resilience affects financial performance and long-term growth. The report identifies escalating cyber threats as a material challenge. The Bank of England's 2026 H1 Systemic Risk Survey found that 82 percent of UK banks, insurers and asset managers cited cyber-attacks as a top five risk to the financial system, up ten percentage points from 2024. In 2024-25, highly significant incidents reported increased by 50 percent year-on-year, with nearly half of all incidents meeting the National Cyber Security Centre (NCSC) threshold for national significance. The report demonstrates that resilience extends beyond compliance and cost reduction. Organisations with stronger resilience capabilities outperform their peers in revenue growth, profitability and customer trust. Highly resilient companies grow revenue 6 percentage points faster than their peers and maintain profit margins 8 percentage points higher than the median industry company over a three-year horizon. Among firms in the highest resilience quartile, 60 percent record profit gains following severe shocks, compared with 21 percent among the least resilient. The report emphasises that resilience is a foundational enabler of growth and innovation, allowing firms to modernise systems and adopt new technologies without disruption to delivery. HM Treasury positions cyber resilience as a strategic organisational capability rather than solely a technical or compliance function, supporting both risk mitigation and sustained business performance in an increasingly digital financial environment.

On July 8, 2026, the European Data Protection Board (EDPB) adopted Guidelines 02/2026 on Anonymisation. These guidelines clarify the notion of anonymous data and provide a practical framework for determining whether data has been successfully anonymised. This guidance will therefore help to ensure that data is safely anonymised where possible and proportionate, allowing for free use of data while preserving the rights and protections of natural persons. The framework presents three criteria which can be used to test if data is anonymous: No Record Isolation, No Linkage and No Inference. These criteria should be used to assess the effectiveness of possible (re-)identification techniques. If all three criteria are passed, under either the contextual or the simplified approach, then the given data can be safely considered anonymous. If any criterion fails, further analysis should be done to determine if the data may nevertheless be considered anonymous.

On July 7, 2026, the Austrian Financial Market Authority (FMA) announced it had imposed a €18,400 fine to BTV Vier Länder Bank AG for breaches against Regulation (EU) 2017/1129 (Prospectus Regulation). The FMA found that BTV Vier Länder Bank AG specifically failed to publicise that a prospectus had been published which constituted a breach of Article 22 (2) of the Prospectus Regulation. The penal order is final.

On July 8, 2026, the European Securities and Markets Authority (ESMA) published its final report containing draft Regulatory Technical Standards (RTS) specifying elements that central counterparties (CCPs) must consider when establishing admission criteria for clearing members and assessing non-financial counterparties' (NFCs) ability to meet margin and default fund obligations. The RTS do not set the actual admission criteria but instead define the elements for CCPs to consider. The RTS implement requirements introduced by Regulation (EU) 2024/2987 (EMIR 3), which amended Article 37 of Regulation (EU) 648/2012 (EMIR) on participation requirements. ESMA conducted a public consultation from October 9, 2025 to January 5, 2026, receiving 13 responses from CCPs, clearing members and clients. The final RTS incorporate feedback addressing concerns about proportionality, operational feasibility and the avoidance of duplication of existing supervisory functions. The RTS will now be submitted to the European Commission for endorsement, following which it will be subject to scrutiny by the European Parliament and the Council.

On July 8, 2026, the European Commission opened a targeted consultation to gather views on challenges to data sovereignty and international data flows affecting European Union organisations. The consultation seeks to understand data-related dependencies affecting EU organisations, including barriers to accessing or using data in third countries, obstacles to transferring data to the EU and risks linked to third-country access to sensitive data. The consultation addresses concerns outlined in the November 2025 Data Union Strategy, which emphasises the importance of safeguarding EU data sovereignty and strengthening the EU's global position on international data flows. It complements the European Tech Sovereignty Package, which contains measures to strengthen the EU's capacity in semiconductors, artificial intelligence (AI), cloud computing and open source technologies. Together, these initiatives support Europe's ambition to become an AI continent, strengthen its digital autonomy and build a more sustainable digital future. The commission notes that data is essential for Europe's competitiveness and security and plays a key role in advancing AI. However, unjust data localisation requirements, discriminatory rules and data leakage to third countries threaten to undermine sovereignty. The targeted consultation is open to actors across the data value chain in different sectors. The comment period closes on September 8, 2026 and can be submitted via a portal which can be accessed here .

On July 7, 2026, the Isle of Man Gambling Supervision Commission (GSC) published its first standalone National Risk Assessment (NRA) on Proliferation Financing (PF), providing a comprehensive evaluation of PF threats, vulnerabilities, and consequences across the jurisdiction. The assessment concludes the Island's 2026 suite of NRAs ahead of its MONEYVAL mutual evaluation onsite in autumn 2026. The NRA finds the Island's overall residual PF risk is medium-low, reflecting strong legal frameworks, effective implementation of international sanctions, and limited direct exposure to countries of proliferation concern. However, the assessment notes that consequences of any PF failure would be significant for the Island, rated as medium impact. The GSC highlighted particular risks within online gambling, where cyber-enabled crime typologies and virtual asset links may create indirect PF exposure. The assessment documents patterns including use of gambling accounts to launder proceeds stolen by Democratic People's Republic of Korea-linked cyber actors and links between customer wallets and state-sponsored hacking groups. The GSC noted that PF understanding remains less mature than anti-money laundering and terrorist financing (AML/TF) frameworks, identifying priorities including targeted industry training, improved PF data collection, and sector-specific typologies. Regulated businesses must incorporate the NRA's findings into their Business Risk Assessments (BRAs) as required by AML/CFT Codes. The GSC intends to conduct a follow-up PF survey to assess operators' awareness and control frameworks since 2024. Industry stakeholders should review risk assessments, update sanctions and virtual asset controls, incorporate PF-specific red flags into monitoring frameworks, and enhance staff training on proliferation financing risks distinct from ML/TF.

On July 6, 2026, the Australian Securities and Investments Commission (ASIC) issued the ASIC Corporations (Amendment and Repeal) Instrument 2026/564, a legislative instrument that came into force on the same date. The instrument amends and repeals provisions under the Corporations Act 2001 and the Corporations (Fees) Act 2001 , which are administered by the Department of the Treasury. The instrument is mainly a clean-up and consolidation measure. ASIC has introduced a new platforms instrument, ASIC Corporations (Platforms IDPSs and IDPS-like Schemes) Instrument 2026/395, which replaces two older instruments dealing with Investor Directed Portfolio Services (IDPSs) and IDPS-like schemes. This new instrument updates other ASIC rules so they now refer to the new platforms instrument instead of the old ones. It also repeals two superseded instruments: ASIC Corporations (Investor Directed Portfolio Services Provided Through a Registered Managed Investment Scheme) Instrument 2023/668 ASIC Corporations (Investor Directed Portfolio Services) Instrument 2023/669 This amends a range of ASIC instruments dealing with: Managed discretionary account services Nominee and custody services Financial requirements for CSF intermediaries ASIC fee complexity criteria Share and interest purchase plans Hardship withdrawals relief Shorter PDS and disclosure rules for platform operators and superannuation trustees Financial requirements for retail OTC derivatives issuers Financial requirements for responsible entities, IDPS operators and corporate directors of retail Corporate Collective Investment Vehicle (CCIVs) Custodial or depository service providers IDPS relevant interests

On July 7, 2026, the Commission de Surveillance du Secteur Financier (CSSF) published a notice addressing evolving cybersecurity opportunities and risks associated with frontier artificial intelligence (AI) models and their adoption by financial institutions. The CSSF identified that recent advances in frontier AI models are expanding capabilities across multiple domains, creating significant opportunities but also introducing new cybersecurity challenges. Frontier AI models can process vast amounts of information, generate sophisticated code and automate complex workflows, which are capabilities that malicious actors may leverage to increase the scale, speed and effectiveness of cyberattacks. The CSSF noted that traditional cybersecurity measures, including vulnerability and patch management, show serious limitations in this evolving threat landscape. Frontier AI models have the potential to drastically reduce the time window between vulnerability disclosure and active exploitation, challenging conventional patch management approaches. The CSSF observed that many supervised financial institutions have insufficient vulnerability scanning frequency and delayed remediation. Additionally, many entities do not review network safeguards as frequently as required and lack automated reviews of secure configuration baselines. The CSSF calls on supervised entities to review publications from the European Systemic Risk Board (ESRB) and the Financial Stability Board (FSB) on AI adoption and cyber resilience. The CSSF expects all management bodies to establish governance structures that support effective frontier AI-related risk management and to strengthen organisational resilience against AI-enabled threats, in line with the ICT risk management requirements set out in the Digital Operational Resilience Act (DORA). The CSSF details measures for entities to consider, such as: Reducing attack surface exposure. Prioritising patch management by exposure and exploitability rather than theoretical severity. Securing software development pipelines. Engineering for containment to reduce the blast radius. Conducting proactive threat hunting. Implementing no-patch response procedures. Adopting AI for defence. Testing cybersecurity defences and incident response plans. These recommendations apply to all DORA-regulated entities, including credit institutions, investment firms, payment institutions, electronic money institutions and other supervised financial service providers.

In a decision dated July 6, 2026, the Dutch Central Bank (DNB) imposed an administrative fine of €8.5m on ABN AMRO Bank N.V. for serious deficiencies in its anti-money laundering controls between September 2023 and September 2024. The DNB identified structural shortcomings in ABN AMRO's execution of ongoing customer due diligence for high-risk clients. The investigation revealed that ABN AMRO conducted insufficient, non-critical and superficial client examinations. Across five client files examined, the DNB found concrete risk signals, including large cash withdrawals by individuals, transactions with high or elevated-risk countries, substantial and frequent commission payments, possible involvement with dual-use goods and indicators of potential sanctions evasion against Russia through intermediaries. ABN AMRO failed to investigate these signals with adequate depth and did not take sufficiently rigorous action to manage risks appropriately. The bank also regularly closed investigations without conducting appropriate follow-up or implementing adequate measures, despite elevated risks. The DNB considered ABN AMRO's substantial financial capacity, the seriousness of the violation, and the bank's remedial measures and constructive approach when determining the penalty amount.

In a decision dated March 2, 2026, the Commission de Surveillance du Secteur Financier (CSSF) imposed an administrative fine of €12,000 on PingPong Europe S.A., an electronic money institution (EMI), for non-compliance with professional obligations related to anti-money laundering and counter-terrorism financing (AML/CTF). The CSSF identified multiple breaches of AML/CTF professional obligations, under the Law of 12 November 2004 on the fight against money laundering and terrorist financing and CSSF Regulation No 12-02 of 14 December 2012 , following an on-site inspection between October 2022 and October 2023. The EMI failed to file suspicious activity and transaction reports with the Financial Intelligence Unit (FIU) in three cases where suspicious indicators were detected, including two involving fraudulent activity and one involving a predicate tax offence. Additionally, the institution returned funds in two cases before its compliance officer determined whether reporting to the FIU was required, thereby violating its obligation to refrain from executing suspicious transactions until the FIU is informed. The CSSF also found inadequate recordkeeping practices, preventing the institution from retrieving copies of the reports sent to the FIU in 2020 and 2021. The CSSF also found that the EMI's AML/CTF supervisory systems were inadequate for its high client volume, failing to properly distinguish among blocked, terminated or refused business relationships, and unable to identify incomplete client files or retrieve customer residence information for beneficial owners of legal-entity clients.

On July 8, 2026, the Malta Financial Services Authority (MFSA) announced the launch of a new Public-Private Partnership (PPP) on Fraud Detection and Prevention, designed to strengthen the detection, prevention and disruption of financial fraud through enhanced national coordination. The initiative brings together key public authorities and leading financial institutions to address increasingly sophisticated fraud risks affecting consumers and the wider financial system. Permanent members of the PPP include the MFSA, Malta Police Force, Office of the Arbiter for Financial Services, Financial Intelligence Analysis Unit, and the Central Bank of Malta. Non-permanent private sector members comprise the Malta Bankers' Association and local credit institutions providing retail payment services. Led by the MFSA's Financial Crime Compliance function, the partnership establishes a structured framework for cooperation that enables the systematic sharing of insights on fraud typologies, emerging trends and sector vulnerabilities. The partnership operates around four core pillars: Sharing fraud typologies, emerging trends, best practices and lessons learned. Enhanced cooperation and coordination across regulators, law enforcement and the private sector. Guidance and outreach to build capability and promote consistent application of good practices. Support for policy development with targeted, risk-focused supervisory engagement. Key themes emerging from discussions include the importance of informed and vigilant customers as an effective line of defence against fraud; the increasingly sophisticated, behavioural nature of modern fraud schemes that rely on psychological manipulation; and the critical importance of timely, trusted information sharing among stakeholders. The partnership recognises that upcoming EU measures will introduce enhanced monitoring and data-sharing obligations, underscoring the need for more coordinated responses to complex, cross-border fraud risks.

On July 8, 2026, the Financial Action Task Force (FATF) released a report examining how public-private partnerships (PPPs) and information sharing mechanisms can help jurisdictions and the private sector detect, analyse and disrupt financial crime activity. The report, titled "Information Sharing to Combat Illicit Finance: Global Overview of Public and Private Sector Partnerships and Data Protection Arrangements", addresses the urgent need for authorities and the private sector to work together to combat money laundering, terrorist financing and proliferation financing (ML/TF/PF) in an era of increased digitalisation and complex cross-border transactions. FATF identified at least 84 public-private partnerships globally, with 52 surveyed jurisdictions reporting at least one domestic PPP and 18 reporting more than one. The report finds that PPPs function as permanent, effective instruments for combatting ML/TF/PF when supported by a robust legal basis, clear governance and technological innovation. More than 75 percent of reporting jurisdictions use PPPs to share strategic information such as typologies, red flags and risk trends, while 55 to 66 percent of jurisdictions have PPPs for operational information sharing, including case intelligence, suspicious transaction report indicators and know your customer (KYC) data. The report highlights key innovations that strengthen information sharing, including encrypted platforms, secure exchanges and the involvement of broader stakeholders such as telecom operators and digital platforms. FATF identifies tools and technologies that enable jurisdictions to balance operational efficiency with compliance, data protection, privacy and human rights obligations, emphasising the need for common objectives and clear legal and regulatory expectations between anti-money laundering and counter-terrorism financing authorities and data protection authorities. The report encourages governments worldwide to adopt PPP models and draw on good practices outlined in the guidance to counter increasingly sophisticated criminal methods and the growing threat from fraud.

In a decision dated June 5, 2026, the Hellenic Data Protection Authority (HDPA) issued Decision 8/2026, imposing financial penalties on an electricity provider and Piraeus Bank for breaches of the General Data Protection Regulation (GDPR). The HDPA examined two complaints filed by the same individual regarding violations of the right of access to personal data. The complaints concerned standing orders for direct debit payments on three electricity accounts that the complainant disputed. Piraeus Bank was fined €10,000 for violating the right of access. Additionally, the bank received a formal reprimand for its failure to ensure data accuracy.

On July 7, 2026, the Australian Communications and Media Authority (ACMA) announced that it had issued formal warnings to the following entities for providing prohibited and unlicensed regulated interactive gambling services: Sky Rain Limited , the provider of the 7Signs service. Spades Limitada , the provider of the Jack Club service. Latcas B.V. , the provider of the Slots Gem service. Ryker B.V. , the provider of the Freshbet service. Metlait SRL , the provider of the Spinrise service. NovaForge Ltd , the provider of the Wildsino service. ACMA stated that the aforementioned entities were found to have violated subsections 15(2A) and 15AA(3) of the Interactive Gambling Act 2001 . The entities offered prohibited gambling services including casino-style games of chance or mixed chance and skill, and services for the placing, making, receiving or acceptance of bets. The aforementioned entities are not licensed within any Australian State or Territory, and their respective services also had Australian customer links.

On July 6, 2026, the Central Bank of the United Arab Emirates (CBUAE) imposed a financial penalty of AED 1,820,000 on a branch of a foreign bank operating in the UAE. The penalty followed CBUAE examinations that found the branch had failed to issue a liability letter within the mandated seven-day period. This was treated as a breach of the CBUAE’s Market Conduct and Consumer Protection Regulations and Standards . The legal basis cited is Federal Decree-Law No. 6 of 2025 Regarding the Central Bank, Regulation of Financial Institutions and Activities, and Insurance Business .

On June 25, 2026, Colombia's Ministry of Finance and Public Credit published a decree proposing amendments to Decree 2555 of 2010 . The amendments address exceptions to transactions counted toward compliance with the limits established in the regulations for the identification and management of large exposures and risk concentration at credit institutions. Two new categories of transactions are added to Article 2.1.2.1.4 of Decree 2555 of 2010 as exemptions from the large exposure limit calculation: foreign exchange transactions that must be channeled through designated channels and are reflected in overseas bank accounts registered with the Central Bank as clearing accounts, provided that such transactions are settled within three business days following their execution. transactions arising from the provision of acquiring services intended to fulfill payment orders and fund transfers for payment to merchants or aggregators carried out through low-value payment systems, and transactions generated in connection with the payment of taxes, provided that such transactions do not exceed one business day following their settlement. foreign exchange transactions that must be channeled through designated channels and are reflected in overseas bank accounts registered with the Central Bank as clearing accounts, provided that such transactions are settled within three business days following their execution. transactions arising from the provision of acquiring services intended to fulfill payment orders and fund transfers for payment to merchants or aggregators carried out through low-value payment systems, and transactions generated in connection with the payment of taxes, provided that such transactions do not exceed one business day following their settlement. For the exempted transactions, credit institutions must establish policies, controls, and limits, in relation to their capital base, for managing the risk of large exposures and risk concentration, in accordance with the instructions issued for this purpose by the Financial Superintendency of Colombia. The National Development Finance Corporation (FDN) may approve a limit different from that set forth in the articles, exceeding 45 percent of the equity base referred to in paragraph 4 of Article 2.1.2.1.2 of the decree, provided that it pertains to the financing of infrastructure projects-including contracts entered into for the provision of services associated with such projects-that are executed through public-private partnership (PPP) schemes or through public works contracts, as well as for the specialized financing of high-quality projects. The FDN must prepare a technical document for each such project and submit it to the Financial Superintendency of Colombia following Board approval. The Financial Superintendency of Colombia is required to issue implementing instructions within six months of the decree's entry into force. The decree takes effect the day following its publication (June 26, 2026).

On July 8, 2026, the Account-to-Account (A2A) Payments Roundtable released its vision for Australia's A2A payments system, incorporating feedback from public consultation and stakeholder engagement. The vision establishes a long-term direction for Australia's A2A payments system, aiming to create a trusted infrastructure that meets evolving needs of consumers, businesses, and government agencies while supporting resilience, competition, innovation, and productivity. A2A payments underpin Australia's economy, facilitating millions of daily transactions including wage payments, superannuation, welfare, bills, taxes, and personal transfers. The vision centres on five outcomes for end-users: safety, reliability, affordability, ease of use, and inclusivity. To deliver these outcomes consistently, the system must demonstrate six characteristics: security and protection; high availability and resilience; feature and capability richness; accessibility for providers; commercial viability; and appropriate standardisation. These characteristics require clear, collaborative, and adaptable governance arrangements ensuring the A2A payments system remains a trusted national asset operating in the public interest. Extensive engagement shaped the vision, including workshops, bilateral discussions, and public consultation. Stakeholder feedback—from banks, payment service providers, fintechs, technology companies, merchants, industry bodies, and government agencies—demonstrated strong support for a shared national vision, enhanced A2A capability, and modernised payments infrastructure. Stakeholders emphasised the need for clarity on implementation, prioritisation, and sequencing. The Roundtable now shifts focus to developing the A2A payments roadmap, which will define deliverables, implementation timelines, and governance arrangements.

On July 8, 2026, the New York State Attorney General, alongside a coalition of 45 other state attorneys general, announced a $45m settlement agreemen t with Block, which operates the peer-to-peer (P2P) payments application Cash App, for misleading users and failing to protect them from fraud and scams. The attorneys general determined that Block misled Cash App users through advertising that falsely stated that the application provided bank-level protections for customer funds, despite the it lacking a consistent fraud detection system and having no functioning fraud hotline for users to report scams. Furthermore, the attorneys general found that: Block was aware of rising incidents of fraud on its platform, but prioritized acquiring new customers over strengthening protections. Cash App's account creation process lacked security measures, requiring no Social Security number (SSN) or date of birth, and imposing no limit on accounts per person. Block's "Cash App Fridays" social media promotion encouraged users to publicly post their unique identifiers, which fraudsters exploited to steal login information. The absence of a customer service phone line until 2021 led users to call fake numbers operated by scammers posing as Cash App support, resulting in account takeovers and financial theft. In addition to its $45m financial penalty, the settlement terms also dictate that Block must: Maintain customer support services that can resolve fraud complaints, account lockouts and other problems. Offer live support 24 hours a day, with a real person available by phone at least 13.5 hours a day and by live chat at least 18 hours a day. Stop false or misleading claims about Cash App's safety and how it protects users from fraud. Discontinue marketing practices known to increase fraud on the platform. Directly educate consumers about common types of fraud. Fulfill its legal obligations to investigate fraud claims and reimburse users for unauthorized transactions.

On July 8, 2026, the US Office of Foreign Assets Control (OFAC) issued an amended Russia-related General License 13R , which authorizes specified administrative transactions related to Russia that would otherwise be prohibited under Directive 4 of Executive Order 14024 . The general license permits US individuals and entities to conduct certain limited administrative activities in relation to Russian sanctions programs. This includes transactions necessary for the orderly wind-down of operations, maintenance of existing accounts and other administrative functions that do not involve the provision of new services or the expansion of business relationships with sanctioned Russian individuals or entities. Additionally, OFAC amended two associated Russia-related frequently asked question (FAQ) documents: FAQs 999 and 1118 . These FAQs provide additional guidance and clarification on the scope and application of General License 13R, addressing common compliance questions from financial institutions and other individuals and entities subject to Russia-related sanctions.

On July 7, 2026, the Central Bank of Colombia (BRC) published for public comment a draft regulation modifying External Regulatory Circular DSP-465 concerning the interoperability of low-value immediate payment systems. The modifications update several key provisions of the original circular issued March 31, 2026. Key changes include: Updated payment classifications. The draft retains existing categories of Payment to a Merchant and Payment to an Individual, and introduces a new category, "Payment to a Legal Entity", covering transfers where the beneficiary is a legal entity without an acquiring relationship. Introduction of a Payment Reference field. The draft introduces a "Payment Reference" , a numeric or alphanumeric code linked to a payment order that allows the beneficiary to identify the underlying good or service. Participants must offer up to two such fields at the point of initiating a transaction, with the BR to separately define the applicable technical guidelines. Updated operational and messaging standards (Annex 5). Annex 5, covering ISO 20022 message formats, timestamp requirements, the 20-second maximum processing time obligation, and operational reconciliation processes, is updated to reflect revised standards for both Intra-SPBVI and Inter-SPBVI transaction flows. Updated Bre-B brand rules (Annex 6). Additional rules on the use of the Bre-B brand are incorporated, extending obligations to Participants that do not offer Payment Instruments, their partners, and affiliated third parties engaged in merchant aggregation activities. New framework for participants without payment methods (Annex 8). A new annex establishes rules for participants that do not offer their own payment instruments. Administrators of an immediate low-value payment system (EASPBVIs) must require such participants to manage keys through either the service delivery channels of the participant holding the associated Payment Instrument or through the EASPBVI directly, and to clearly disclose to customers that transactions are processed via Bre-B. EASPBVIs must certify compliance with key resolution and transaction processing obligations for these participants in line with BRC guidelines. Comments and relevant feedback should be sent here by July 22, 2026.

The Securities and Exchange Board of India (SEBI) has issued the Securities and Exchange Board of India (Mutual Funds) (Amendment) Regulations, 2026. The amended regulations contain: Regulations prescribing a new provision that allows mutual funds to engage in intraday borrowing. Specific rules mandating that this intraday borrowing is permitted exclusively for the purpose of addressing timing mismatches between the outflows and inflows of a mutual fund scheme. Provisions outlining that any such intraday borrowing activities remain subject to further conditions specified by the Securities and Exchange Board of India (SEBI). Th amendments took effect on July 3, 2026.

On July 7, 2026, the Dubai Financial Services Authority (DFSA) published Consultation Paper No. 173 proposing a comprehensive overhaul of its Collective Investment Fund framework . The consultation proposes: Replacing the current specialist classifications for Qualified Investor Funds (QIFs) and Exempt Funds with a more flexible, risk-based framework focused on the activities undertaken, the risks presented and the safeguards required. Proposes applying certain risk management requirements horizontally across all fund managers To introduce enhanced disclosure requirements for borrowing and leverage, extending rules governing the use of prime brokers Retaining targeted safeguards for funds pursuing credit investment strategies while removing several prescriptive specialist fund requirements. The proposals would also simplify the authorisation framework by clarifying that the regulated activities of Dealing in Investments as Agent and Arranging Deals in Investments are covered by a Managing Assets licence where they are undertaken as part of delegated investment management. In addition, the DFSA proposes: Updating master-feeder fund rules Broadening the definition of a master fund Removing the External Fund Manager regime in favour of full DFSA authorisation Expanding opportunities for employees to invest in private funds managed by their employer Extending the first annual reporting period for new funds from 12 to 18 months Making technical amendments to the Collective Investment Law and related Rulebook provisions The consultation seeks early-stage feedback on the future regulation of tokenised fund units, tokenised assets and tokenised money market funds, as well as the possible introduction of a long-term investment fund regime that could provide retail investors with access to illiquid real-economy assets subject to appropriate investor safeguards. The proposals are intended to align the framework more closely with international standards and regulatory best practice, improve clarity, reduce unnecessary regulatory burden, and adopt a more proportionate, risk-based approach to investor protection. Responses to the consultation must be submitted via the regulator's website by September 7, 2026. If adopted, the DFSA proposes a general transition period of three months following the finalisation of the legislative and Rulebook amendments.

On July 7, 2026, the South African Financial Sector Conduct Authority (FSCA) published its 2026–2029 Three-Year Regulation Plan, setting out the regulator's strategic legislative and regulatory priorities through March 31, 2029. The plan provides an updated roadmap for regulatory reforms across South Africa's financial sector and outlines indicative timelines for consultations, rulemaking and implementation. The Regulation Plan confirms that implementation of the Conduct of Financial Institutions (COFI) Bill remains the FSCA's primary strategic priority. Alongside the COFI transition, the regulator will continue developing cross-sector regulatory frameworks covering governance, outsourcing, operational resilience, beneficial ownership, payment services, collective investment schemes, retirement funds, and financial market infrastructure. The plan also identifies several emerging regulatory priorities expected to inform future policy development, including: Artificial intelligence Open Finance Sustainable Finance Cloud computing Data management and data risk The transition from the Johannesburg Interbank Average Rate (JIBAR) to the South African Rand Overnight Index Average (ZARONIA). The FSCA states that it intends to minimise regulatory burden by sequencing reforms, limiting the introduction of new projects where possible and using phased implementation supported by stakeholder consultation. The Regulation Plan notes that project timelines remain indicative and may change depending on legislative progress and other external dependencies.

On July 7, 2026, the US Federal Reserve Board (FRB) requested comment on a proposal to amend its requirements for banks to maintain anti-money laundering and counter-terrorism financing (AML/CTF) programs. The amendments align with changes to AML/CTF program requirements separately proposed by other federal financial regulators, with the proposal introducing several key modifications to existing AML/CTF requirements. Specifically, banks would be required to focus their AML/CTF resources based on risk assessment, with heightened attention directed toward higher-risk customers and activities. The amendments also mandate that banks incorporate the AML/CTF priorities of the US Financial Crimes Enforcement Network (FinCEN) into their risk assessment processes. Additionally, under the proposal, the FRB would shift its supervisory and enforcement focus to concentrate on significant failures in program implementation, rather than technical compliance issues, once a bank has established an AML/CTF program. These changes represent a material risk-based approach to AML/CTF compliance, allowing banks to allocate resources more efficiently while maintaining robust protections against financial crime. Interested parties may submit comments on the proposal until September 5, 2026 at this link .

On July 7, 2026, the US Office of Foreign Assets Control (OFAC) revoked Iran-related General License X and issued Iran-related General License X1 . The amended general license addresses the revocation and wind down of authorization for the production, delivery and sale of crude oil, petrochemical products and petroleum products of Iranian origin. This action represents a modification to OFAC's Iran sanctions program, which regulates transactions and activities involving Iran and Iranian-origin commodities. The issuance of the amended general license establishes new parameters for entities previously operating under the prior authorization, requiring compliance with updated terms and conditions for any ongoing or future transactions involving Iranian crude oil, petrochemical products and petroleum products.

On July 7, 2026, the European Union Agency for Cybersecurity (ENISA) published recommendations addressing cybersecurity challenges in the frontier artificial intelligence (AI) era. The publication provides national competent authorities in member states, EU policymakers, defenders and service providers with an initial set of recommendations to support their respective roles in developing operational capabilities to address machine-speed threats. The recommendations are designed to assist stakeholders in preparing for and responding to cybersecurity risks emerging from advanced artificial intelligence systems. ENISA emphasises that the recommendations are not an exhaustive checklist but rather an initial framework to guide organisations and authorities in strengthening their defences against AI-driven threats. ENISA intends to further refine and expand these recommendations through close cooperation with member states and EU information and communication technology security bodies (EUIBCs). The agency will align its work with the upcoming European Commission Action Plan on artificial intelligence, ensuring consistency with broader EU policy objectives on AI governance and cybersecurity.

On July 7, 2026, Sweden's Ministry of Finance (Finansdepartementet) published a legislative referral proposing amendments to the Act on Services in the Internal Market (2009:1079) to strengthen oversight of how service providers handle customer complaints. The proposal introduces a specific market law sanction for service providers that fail to meet their obligation to respond to complaints from service users as soon as possible and to make a prompt, good-faith effort to find a satisfactory resolution. Under the proposed amendments, service providers that breach these requirements could be compelled to comply. The proposal grants the Consumer Ombudsman (Konsumentombudsmannen) the same investigative and supervisory powers under the Marketing Act (2008:486) when overseeing complaint handling by service providers. This alignment of powers aims to enable effective supervision of service providers' complaint management practices across Sweden. The legislative changes are designed to address deficiencies in customer service by establishing clearer enforcement mechanisms and expanding the Consumer Ombudsman's authority to take action against non-compliant service providers. There are already legal requirements today that mean that companies in large parts of the service sector must respond to complaints as soon as possible and find a solution quickly. However, failure to comply with the rules does not lead to any legal consequences under the law, nor is there any authority responsible for checking that the rules are followed. The proposals in the legislative council's report mean that companies that do not provide customer service in accordance with the rules may be required to pay a fine. The proposal reflects Sweden's commitment to strengthening consumer protection in the services sector. The proposed amendments are scheduled to enter into force on March 1, 2027.

On July 7, 2026, the European Banking Authority (EBA) published the final report on the draft guidelines specifying the authorisation regime for third-country branches (TCBs) in accordance with Article 48c(8) of Directive 2013/36/EU (Capital Requirements Directive). The guidelines establish minimum harmonised requirements across EU member states for authorising branches of third-country undertakings that provide core banking services, specifically deposit-taking, lending and guarantees or commitments, within the EU. The guidelines detail the information applicants must submit, including corporate structure, financial statements, business plans, internal governance arrangements, capital endowment details, liquidity requirements, booking arrangements and reporting requirements. The guidelines will be translated into official EU languages and published on the EBA website. The deadline for competent authorities to report whether they comply with the guidelines will be two months after the publication of the translations. The guidelines will apply from January 11, 2027.

On July 7, 2026, the European Commission presented an action plan addressing the risks and opportunities posed by advanced artificial intelligence (AI) models for cybersecurity across the European Union (EU). The plan recognises that although AI can strengthen cybersecurity defences, advanced AI models can also be misused to identify vulnerabilities, automate attacks and increase the scale and speed of cyber incidents at unprecedented levels. The action plan establishes several key initiatives to strengthen EU cybersecurity. The commission will launch a dedicated call to establish an EU evaluation capacity for advanced AI models, expected to be operational in 2027, to strengthen third-party assessment of AI capabilities and risks. Working with the EU Agency for Cybersecurity (ENISA), the commission will define a European blueprint for structured access to advanced AI systems for cybersecurity purposes, supporting relevant European public and private organisations. ENISA and the commission's Joint Research Centre will create a secure testing platform for AI in cybersecurity, including simulated environments, to support operators in critical sectors such as finance, energy, health, transport and public administration. The commission will also launch the EU Grand Challenge on AI for cybersecurity, a competition to develop AI solutions for cybersecurity, and will support partnerships between public authorities, businesses, and open-source communities to secure critical open-source software. The action plan builds on existing EU legal frameworks. The AI Act requires assessment and mitigation of risks from AI models, with enforcement beginning from August 2, 2026. The Cyber Resilience Act, applicable by the end of 2027, mandates security by design for hardware and software products. The Network and Information Systems (NIS2) Directive and Digital Operational Resilience Act (DORA) strengthen security in critical sectors, while the Cyber Solidarity Act enhances EU capacity to detect, prepare for, and respond to significant cybersecurity threats.

On July 8, 2026, the Financial Conduct Authority (FCA) published public information about the authorisation application form for cryptoasset firms seeking to undertake new cryptoasset regulated activities under the Financial Services and Markets Act (FSMA). The document is intended to help applicant firms understand the information they must include with their applications. The application guidance is structured into two broad categories: Sections applicable to most firms applying for authorisation regardless of business model or sector. Information specific to cryptoasset firms based on their business model and regulated activities. Application components include firm details and organisation structure, business model and strategy, governance and compliance, and activity-specific requirements. Depending on their intended activities, firms must provide information on issuing qualifying stablecoins, safeguarding cryptoassets, staking, lending and borrowing, intermediary services, and operating cryptoasset trading platforms (CATPs). The guidance specifies that applicants must submit regulatory business plans, financial forecasts, IT self-assessments, compliance frameworks addressing financial crime prevention and money laundering regulations, and policies addressing conflicts of interest, market abuse detection, and consumer protection. The FCA emphasised that the guidance is provided on a best endeavours basis and does not constitute legal advice and firms are responsible for the accuracy and completeness of information supplied.

On July 7, 2026, the National Bank of Ukraine (NBU) revoked the financial services licence of Sent Pro. The NBU's Committee on Supervision and Regulation of Non-Bank Financial Services Markets made this decision on July 6, 2026. The NBU revoked the licence because Sent Pro repeatedly violated mandatory prudential requirements concerning leverage ratios as defined in the Regulation on Prudential Requirements for Financial Companies . The company also repeatedly breached requirements under the Regulation on Authorisation of Financial Service Providers and Conditions for Conducting Financial Services Activities . Sent Pro was authorised to provide credit services, including the provision of funds and banking metals on credit. After licence revocation, a financial company loses the right to conduct financial services activities. However, licence revocation does not exempt the company from fulfilling its obligations under existing financial services contracts.