Published

On July 3, 2026, the European Commission announced that it had adopted revised European Sustainability Reporting Standards (ESRS) and a voluntary reporting standard for smaller companies. The revised standards are designed to reduce administrative burdens for EU businesses while maintaining high-quality sustainability disclosures covering environmental, social, and governance issues, including climate change, biodiversity, and human rights. The revised ESRS reduce the number of mandatory datapoints by over 60 percent and the total number of datapoints by over 70 percent. These changes are expected to reduce reporting costs by more than 30 percent per company, exceeding the Commission's target of reducing burdens associated with reporting requirements by 25 percent. The standards are shorter and clearer, add new flexibilities, and streamline key processes. The delegated acts revising the ESRS and establishing the voluntary reporting standard will now be transmitted to the European Parliament and the Council of the EU for scrutiny. The measures will apply once the scrutiny period of two months, which can be prolonged by a further two months, is over.

On July 3, 2026,  Armenia's State Revenue Committee presented proposed amendments to the National Assembly regarding online gambling regulation and financial account information exchange. The amendments modify the Law on Regulation of Gambling Activities and related legislation, as well as the Tax Code of the Republic of Armenia. The online gambling amendments aim to strengthen oversight of the online gambling sector and enhance the effectiveness of existing regulations. In recent years, the gaming services market has significantly shifted online, making unlicensed operators' services accessible to Armenian users despite operating outside Armenia's legal framework. While current regulations establish licensing, advertising restrictions, and oversight mechanisms, they lack sufficient enforcement tools in the online environment to restrict access to unlicensed websites, prevent their advertising, and monitor financial flows. The proposed changes introduce several measures to close regulatory gaps and improve state oversight effectiveness. These include improving mechanisms to block unlicensed websites, restricting their advertising, strengthening financial flow monitoring, limiting telecommunications operators' provision of access to such sites, and restricting licensed gaming operators from receiving or transferring funds through commercial banks and payment organisations. The amendments aim to protect the licensed gaming market, ensure fair competition, and enable more effective state oversight online. The financial account information amendments modernise Armenia's automatic exchange of financial account information system to align with international standards and best practices established by the Organisation for Economic Co-operation and Development (OECD). The amendments clarify key concepts and procedures, transfer oversight responsibility to the tax authority, establish penalties for providing false or incomplete information, and extend the reporting deadline from May 10 to June 30. These changes promote more effective implementation of the automatic exchange system, fulfil international obligations, and enhance tax administration efficiency.

On July 3, 2026, the Isle of Man government published its first standalone National Risk Assessment (NRA) on Proliferation Financing (PF) , evaluating how the Island's financial system prevents potential misuse to support the spread of weapons of mass destruction. The report outlines that the sectors with greatest exposure are those serving international customers and cross-border activity, including online gambling. It also outlines that international online business models, cyber-enabled crime typologies and links to virtual assets may create indirect PF exposure, particularly where illicit proceeds (including from cyber-enabled activity) are moved through gambling channels. This assessment concludes the 2026 suite of NRAs ahead of the Island's MONEYVAL mutual evaluation scheduled for autumn 2026. The assessment identifies the Island's overall residual PF risk as medium-low, reflecting strong legal frameworks, effective implementation of international sanctions, and very limited direct exposure to high-risk countries. However, as an international finance centre, the Isle of Man remains exposed to indirect risks through global financial connections, including cross-border transactions and complex international company structures. The assessment confirms the Island maintains a strong framework to counter proliferation financing, including robust sanctions implementation, effective supervision, and strong cooperation between government, regulators and law enforcement. While the likelihood of PF activity remains limited, the report notes that any instance could have serious consequences, reinforcing the need for continued vigilance. The assessment identifies areas for ongoing improvement, particularly increasing awareness, strengthening data collection, and providing further guidance and training to industry. The PF assessment forms part of the Island's wider Financial Crime Strategy 2024–2026 and sits alongside NRAs covering money laundering, terrorist financing, and sectoral risks across banking, insurance, trust and corporate service providers, virtual assets, gambling, legal persons and arrangements, and non-profit organisations.

On July 3, 2026, Europe’s Anti-Money Laundering Authority (AMLA) published three sets of technical standards designed to standardise financial intelligence reporting and cooperation across the European Union. The standards establish common formats for financial intelligence units (FIUs) to exchange information with each other and to report findings to the European Public Prosecutor's Office (EPPO). The finalised standards are: Draft implementing technical standards (ITS) specifying the format to be used by AMLA for reporting to EPPO under Article 41(2) of Regulation (EU) 2024/1620 (Anti-Money Laundering Authority Regulation – AMLAR). Draft ITS specifying the format to be used for the exchange of information between FIUs under Article 31(2) of Directive (EU) 2024/1640 (6th Anti-Money Laundering Directive AMLD 6). Draft ITS specifying the format to be used by FIUs for reporting to the European Public Prosecutor’s Office (the EPPO) under Article 81(1) of Regulation (EU) 2024/1624 (Anti-Money Laundering Regulation – AMLR). The standards have been submitted to the European Commission for adoption. It will apply after publication in the official journal of the European Union. The EPPO reporting rules take effect from July 10, 2027, while certain technical requirements, including fully machine-readable reporting and full FIU.net integration, follow by July 10, 2028.

On July 2, 2026, Slovenia's Ministry of Finance published a proposed amendment to the Law on Changes and Amendments to the Law on the Resolution and Compulsory Winding-Up of Banks (ZRPPB-1C). The proposed legislation implements the requirements of the Bank Recovery and Resolution Directive (Directive 2014/59/EU), which establishes a framework for the recovery and resolution of credit institutions and investment firms across the European Union. The amendment addresses the transposition of EU requirements into Slovenian law, ensuring that the country's bank resolution and winding-up procedures align with the directive's provisions. The proposed act covers mechanisms for managing failing banks and investment firms, including recovery planning, resolution tools and procedures for compulsory winding-up. The legislation applies to all credit institutions and investment firms operating in Slovenia and is significant for maintaining financial stability and depositor protection within the Slovenian banking system. The Ministry of Finance has made the draft legislation available for public consultation. Stakeholders, including financial institutions, industry associations and members of the public may submit comments until August 3, 2026. The government aims to present the proposal to the government board by the fourth quarter of 2026, with adoption expected in the first quarter of 2027. The act is scheduled to enter into force in the first quarter of 2027.

On May 14, 2026, the State Service for Special Communications and Information Protection of Ukraine (SSCIP) approved the Order on the Approval of the Procedure for Monitoring the Activities of the National Team for Responding to Cyber Incidents, Cyber Attacks, and Cyber Threats, Sectoral and Regional Teams for Responding to Cyber Incidents, Cyber Attacks and Cyber Threats (CSIRT). Monitoring is carried out by: Conducting a self-assessment of the compliance of organisational and technical capacity with the maturity level determined by the Requirements for Organisational and Technical Capacity . Conducting a mutual assessment of the compliance of organisational and technical capacity with the maturity level defined by the Requirements for Organisational and Technical Capacity . A self-assessment of the compliance of organisational and technical capacity with the maturity level defined by the Requirements for Organisational and Technical Capacity is conducted by the response team independently at least once a year. The self-assessment is conducted by an employee or a group of employees of the response team of no more than three people. Based on the results of the self-assessment, the employee or group of employees of the response team who conducted the self-assessment shall, no later than 30 days after its completion, prepare a report in the form in accordance with the appendix to the SSCIP. The report shall be signed by the response team member or group of members who conducted the self-assessment and the response team leader. This order shall enter into force on the date of its official publication.

On July 1, 2026, the Supervisory Council of the Bank of Albania adopted a new Regulation on "Digital Operational Resilience" and approved amendments to the Regulation on "Use of Information and Communication Technology by entities licensed by the Bank of Albania". The Bank of Albania introduced these regulatory requirements to address the escalating information and communication technology (ICT) and cyber risks facing banks and other financial entities operating in Albania. The new regulation establishes comprehensive requirements for the effective management of digital and operational risks as the banking and financial services sector undergoes ongoing digital transformation. The regulation forms part of the Bank of Albania's broader effort to align its supervisory regulatory framework with the European Union (EU) acquis, supporting Albania's European Union integration process. The regulation applies to all entities licensed by the Bank of Albania, including banks and other financial institutions operating under its supervision.

In a decision dated May 7, 2026, the French Financial Markets Authority (AMF) announced the withdrawal of AUTOMATA France SAS' registration as a digital asset service provider (DASP), effective June 30, 2026. The AMF initiated the withdrawal proceedings after determining that AUTOMATA France SAS, operating through Vancelian.com, was conducting crowdfunding activities without the required licence. The regulator found that this illegal exercise of activity demonstrated a failure by the company's senior managers and significant shareholders to comply with obligations regarding good repute and competence under the Markets in Crypto-Assets Regulation (MiCA). The AMF set the effective withdrawal date as June 30, 2026, to allow an orderly wind-down of the company's operations. During the wind-down period, AUTOMATA France SAS was permitted to provide only services and conduct operations strictly necessary for the orderly cessation of its affairs. The company was required to return control of clients' access to digital assets in accordance with previously specified client procedures. Following the effective withdrawal date, AUTOMATA France SAS must inform the public of the withdrawal of its registration, remove all references to its AMF registration as a DASP from its website, and finalise its orderly wind-down arrangements.

Spain’s Public Treasury has published guidance for regulated entities on de-risking and a catalogue of risk indicators related to financing the proliferation of weapons. The purpose of the guidance is to clarify the scope and application of the risk-based approach in relations between obliged entities and their customers with a view to reducing instances of de-risking that lead to financial exclusion for certain groups. The guidance defines the practice, highlights key aspects and outlines preventive measures for de-risking, addressing a significant compliance challenge: excessive de-risking can undermine financial inclusion and market access for legitimate businesses and customers. In addition to publishing the de-risking guide, the Public Treasury has also published a catalogue of risk indicators related to the financing of weapons of mass destruction proliferation. The proliferation financing risk indicators provide practical tools for detecting suspicious activity related to weapons of mass destruction financing, a priority area under international sanctions regimes and Financial Action Task Force (FATF) recommendations. Financial institutions, money service businesses and other regulated entities are encouraged to review the guides to enhance their risk identification and mitigation procedures.

The Bank of Thailand (BOT) has issued the Bank of Thailand notification no. 31/2569 regarding the submission of reports on financial movements, financial service usage behaviors, or unusual financial transactions. The notification contains: New definitions for key terms including "commercial banks" and "regulated payment service providers under the payment systems law", which encompass electronic money service providers, electronic payment service providers, and electronic money transfer service providers. Regulations prescribing the mandatory reporting of financial movements or unusual transaction behaviors to the BOT, aimed at preventing financial institutions and payment service providers from being used as tools or channels to support illegal activities. Specific rules mandating the format and channel for reporting, stipulating that reports must be submitted as CSV files via the BOT’s data acquisition and publication (DAP) or application programming interface (API) systems. Provisions outlining the specific report types and frequencies, which include monthly submissions for "unusual customer behavior data" (DS_SBE), "EDD verification results" (DS_SAE), and "transaction details for EDD" (DS_RTD), as well as ad-hoc submissions for "automated financial service machine data" (DS_ATM) whenever changes occur. Administrative measures detailing the submission deadlines, requiring that monthly reports be submitted by the 15th of the following month (by 4:30 PM), with Thai commercial banks starting submissions for the June 2026 data period, and foreign bank branches, subsidiaries, and non-bank payment providers starting from the September 2026 data period. The notification takes immediate effect

The Financial Services Commission (FSC) of South Korea has issued a press release outlining exemption measures and guidelines for financial companies regarding frontier AI security threats. The issued press release contains: Principles prescribing administrative exemptions for minor IT incidents that occur during AI security testing or the implementation of security patches for vulnerabilities disseminated by financial authorities, provided that rapid recovery and consumer protection measures were taken. Specific rules mandating the criteria for "minor IT incidents," which include a lack of intent, financial damage under KRW 100m (US$74,800), a system outage of under 4 hours, and personal information leaks of fewer than 10,000 cases (excluding personal credit information). Provisions outlining the scope of the exemption, which covers institutional and individual sanctions, as well as administrative fines. However, penalties under the Credit Information Act will still apply in the event of a personal credit information leak. Regulations prescribing actionable guidelines for responding to frontier AI threats, emphasizing enhanced executive responsibility, systematic vulnerability and patch management, robust asset and supply chain management, and AI-based defense automation. Directives for implementing automated defense systems, advising that the level of automation and human intervention should be graded based on the risk level of the assets involved (e.g., full automation for low-risk scenarios versus requiring CISO approval for high-risk assets like core banking systems). The measures take immediate effect.

The Bank of Thailand (BOT) has issued the Bank of Thailand Notification No. 30/2569 regarding the Temporary Relaxation of Supervisory Guidelines on Housing Loans and Other Loans Related to Housing Loans for Financial Institutions and Specialized Financial Institutions. The amended notification contains: Administrative measures detailing a temporary one year relaxation of the Loan to Value (LTV) ratio limits from July 1, 2026, to June 30, 2027, to support the real estate sector and its supply chain amid a market slowdown and geopolitical risks. Specific rules mandating the relaxation of the LTV ratio ceiling to 100 percent for all housing loan contracts, including first, second, and subsequent contracts regardless of whether the collateral value is under or over THB10m (US$275,000). Provisions outlining that for first contract housing loans with a collateral value under THB10m, financial institutions may grant additional related loans up to 10 percent of the collateral value. Regulations prescribing a 100 percent LTV ratio limit for loans intended for the construction of a residence on debt free land owned by the borrower. Directives establishing the risk weights for credit risk calculation under the standardised approach or simplified standardised approach, assigning a 35 percent risk weight to qualifying housing loans and varying weights such as 75 percent for retail borrowers or 100 percent for non-retail borrowers for other related loans. The amendments take immediate effect.

The Taiwanese Financial Supervisory Commission (FSC) has fined China Trust Commercial Bank (CTBC Bank) NT$4m (US$125,000) for inadequate internal controls and monitoring mechanisms which enabled an employee to misappropriate ATM and interbank settlement funds. The FSC’s investigation found that, starting from November 2024, CTBC Bank failed to implement effective safeguards across its operations for: Establishing adequate verification mechanisms for the return of long-pending settlement funds. Monitoring abnormal transactions and the concentrated inflow of returned funds into a single account. Executing internal control procedures and maintaining concrete supervisory review records. These deficiencies breached Article 129, Subparagraph 7 of the Banking Act and enabled one employee to facilitate NT$2.97m (US$93,000) in misappropriation operations involving 53 settlement transactions. In addition to the fine, the FSC has also requested that CTBC Bank: Report the offending personnel to the Joint Credit Information Center (JCIC) in accordance with the Bankers Association's regulations. Share the case details in a de-identified manner on the Bankers Association website to serve as a reference for other member institutions.

On July 3, 2026, the European Securities and Markets Authority (ESMA) issued a statement reminding firms of their obligation to assess whether newly offered products fall within the scope of existing product intervention measures on binary options. The statement responds to the growing popularity of prediction markets, also known as event contracts, and increasing retail participation globally. Event contracts are products with binary financial outcomes (a fixed payout or no payout) that depend on a yes-or-no answer to a question about a future event. Whether event contracts qualify as financial instruments depends on the specific event question posed. ESMA clarified that event contracts may also qualify as bets under national gambling legislation. Where event contracts are classified as financial instruments, they constitute derivatives and fall within the scope of existing national product intervention measures on binary options adopted by national competent authorities. These measures prohibit the marketing, distribution, or sale of such products to retail clients. ESMA emphasised that the distribution of event contracts qualifying as financial instruments within the European Union requires authorisation as an investment firm, even where distribution is limited to non-retail clients.

On July 1, 2026, the Dubai Financial Services Authority (DFSA) brought into force two significant Rule-Making Instruments amending the DFSA Rulebook as part of its broader initiative to strengthen the prudential and conduct frameworks applicable to firms operating within the Dubai International Financial Centre (DIFC). The amendments implement changes consulted on under Consultation Paper No. 161 (prudential reforms) and Consultation Paper No. 165 (Authorised Individuals and Conduct Principles reforms). Prudential  Investment, Insurance Intermediation and Banking Business Module (PIB)  - Rule-Making Instrument No. 441 of 2026 The revised PIB Rulebook introduces a restructured prudential framework for DIFC-authorised firms, with the following key changes: Re-categorisation of firms: Firms operating an alternative trading system are reclassified from prudential category 4 to prudential category 3A, aligning their capital treatment with other category 3A firms. Activity-Based Capital Requirements (ABCR): The ABCR framework is introduced as a key component in determining overall capital requirements for category 3A firms, comprising three metrics: the Assets Safeguarded and Administered (K-ASA) requirement at 0.06% of average ASA over the preceding six months; the Assets Under Management (K-AUM) requirement at 0.02% of average AUM over the preceding six months; and the Client Orders Handled (K-COH) requirement at 0.10% of average daily cash trades plus 0.01% of average daily derivatives trades over the preceding six months. Category 3A firms are relieved from risk capital requirements and are instead subject to ABCR. Capital buffers and liquidity: Category 3A firms must maintain a 20% capital buffer as stipulated in PIB 3.2.6 and must hold liquid assets in excess of their base capital requirement or Expenditure-Based Capital Minimum (EBCM), whichever is applicable. Firms whose capital requirement is determined by ABCR must maintain a Common Equity Tier 1 (CET1) ratio of 60% and a Tier 1 ratio of 80% of their ABCR. Professional Indemnity Insurance (PII): PII requirements are removed for firms under prudential categories 3C and 3D. Minimum PII coverage standards are established for domestic firms under categories 3B and 4. Conduct of Business Module (COB) - Rule-Making Instrument No. 442 of 2026 The revised COB Module introduces a reformed Conduct Principles framework and updates the DFSA's approach to Authorised Individuals, with the following key changes: Replacement of Principles for Authorised Individuals with Conduct Principles: The existing Principles for Authorised Individuals are replaced with a revised and expanded set of Conduct Principles, broadening their application beyond Authorised Individuals to a wider population of Relevant Employees within firms, including those in front-office, control functions, and certain outsourced roles. This significantly expands the scope of accountability and ethical expectations across DIFC-authorised firms. Retention of Licensed Functions framework: Following significant stakeholder pushback on CP165 proposals to replace DFSA authorisation with a designation model, the DFSA has decided to retain its existing Licensed Functions framework. Compliance Officers, Finance Officers, and Senior Managers will continue to require DFSA authorisation. The proposed Designated Function and Designated Individual regime will not be introduced at this stage. Fitness and propriety obligations: Whilst the authorisation requirement is retained, the DFSA reaffirmed that Authorised Firms remain fully accountable for the appointment and ongoing fitness and propriety of their employees, including those in key functions, regardless of regulatory approval. The DFSA confirmed that existing Rulebook guidance on fitness and propriety assessments is considered sufficient and no additional prescriptive requirements will be introduced. Enhanced scrutiny of governance arrangements: The DFSA indicated that Authorised Firms should expect additional supervisory scrutiny of their fitness and propriety processes, governance arrangements, record-keeping, and Conduct Principles training for all Relevant Employees going forward. All firms are required to comply with both sets of changes from July 2, 2026

On July 2, 2026, the European Anti-Money Laundering Authority (AMLA) launched a public consultation on draft standards establishing a common format for reporting suspicions of money laundering and terrorist financing across the European Union. Currently, reporting requirements for suspicious activity and transaction records vary significantly between Member States, creating compliance challenges for cross-border operators and hindering the exchange of information between Financial Intelligence Units (FIUs). AMLA's initiative aims to address this fragmentation by introducing harmonised templates and data points for reporting entities while accommodating sector-specific requirements. The common standards will apply to both financial and non-financial sector businesses and professionals subject to anti-money laundering rules. Reporting entities will complete only relevant data points tailored to their activity type and the nature of the suspicion reported. This approach is intended to provide greater clarity and consistency for the private sector, particularly those operating across multiple jurisdictions, while enabling FIUs to receive more structured and comparable information for faster processing and action. AMLA is seeking feedback on its consultation by September 20, 2026, which may be submitted via this link .

On July 1, 2026, the Brazil Securities and Exchange Commission (CVM) published CVM Resolution No. 245, modifying the existing regulatory framework governing investment fund management in Brazil. The amendment updates requirements previously established under Resolution No. 50, which sets out foundational rules designed to prevent money laundering. Under Resolution No. 245, natural or legal persons that provide services related to the distribution, custody, intermediation, or management of portfolios in the securities market must adopt continuous and enhanced monitoring, through the adoption of more rigorous procedures for selecting atypical operations or situations, regardless of the investor's risk classification. Further, the obliged entities must, within the limits of their powers, adopt enhanced due diligence measures in the case of transactions or situations involving non-resident investors who reside, have their headquarters or are incorporated in countries, jurisdictions, dependencies or locations that do not apply or apply insufficiently the recommendations of the FATF, as per lists issued by that organization. Enhanced due diligence measures must at least include: additional restrictions or conditions for establishing business relationships; limitation, postponement or refusal to carry out transactions with assets classified as higher risk; requirement for additional information or proof; and termination of the business relationship when risks deemed unacceptable and unmitigable are identified. The resolution enters into force on July 15, 2026. Market participants, including investment fund managers, administrators, and custodians operating in Brazil's securities markets, should review the amended provisions to ensure compliance with the updated requirements.

The Central Bank of Brazil (BCB) has incorporated virtual asset service providers into the existing prudential framework, continuing the process of regulating the sector, which began with Law No. 14,478/2022 and the formal attribution of powers to the BC by Decree No. 11,563/2023 . With the adoption of Resolution No. 580, the BCB seeks to ensure the soundness of these institutions, mitigate risks to the National Financial System (SFN), and promote regulatory convergence with the prudential framework already applied to other institutions in the system. According to Resolution No. 580, companies providing virtual asset services and the conglomerates they lead will be classified as Type 3, under the terms of BCB Resolution No. 436/2024 , a category that includes institutions subject to regulation by the BCB itself. The classification as Type 3 brings the regulatory treatment of these companies closer to that adopted for brokerage and securities distribution firms, reflecting functional similarities between their business models. Starting January 1, 2027, these institutions will be subject to a set of prudential requirements, including risk management rules, capital requirements, and information disclosure policies. Furthermore, virtual asset service providers will be classified in Segment 4 (S4) by June 30, 2028, regardless of their size. This measure allows for a gradual transition to the full application of prudential rules. The regulation approved by the BCB's Board of Directors also prohibits the provision of virtual asset services by institutions classified in Segment 5 (S5), which is characterized by a simplified regime aimed at institutions with a reduced risk profile. The measure establishes that operating with virtual assets is incompatible with this profile, reinforcing the need for classification in segments with greater prudential robustness. The resolution enters into force on the date of its publication (July 1, 2026).

On July 2, 2026, the Superintendency of Banking and Insurance (SBS) modified regulations governing market conduct management and commissions and expenses within Peru's financial system through Resolution SBS No. 01741-2026. The resolution, published in the Official Gazette, strengthens consumer protections by requiring financial entities to promptly inform users of events that may affect them, including service channel interruptions, cybersecurity incidents affecting users, and events causing losses to account balances or credit lines. For service interruptions, entities must communicate through mass media within 24 hours of becoming aware of the event. For other incidents, entities must inform users within ten business days, providing details on the event and actions taken. It is also indicates that financial institutions should strive to design and market their products and services considering the target audience to which they are directed. The regulation establishes additional requirements for product and service contracting, ensuring independence in purchasing different products through mechanisms guaranteeing transparency, user freedom of choice, and traceability of consent, particularly through digital channels. When users pay obligations through financial entities other than the credit holder, the receiving entity must inform the user of applicable commission amounts before executing the transaction. It also specifies that the lending financial institution may not charge fees for payments made through its own channels. In order to align market conduct regulations with Laws No. 31601 and No. 32327 (laws that modify the legal framework for consumer protection and defense), the resolution stipulates that financial institutions offering automated service systems must provide users with an alternative form of in-person service. Furthermore, they must issue or make available, free of charge and upon request, proof of payment regularization for overdue debts within a maximum period of seven business days. The resolution enters into force 360 days after its publication in the Official Gazette ( June 26, 2027 ), with the exception of the amendments set forth in paragraph 3.2 of Article 3 (principles of market conduct) and Article 41-B (proof of debt settlement), which enter into force on the day following their publication ( July 2, 2026 ).

On June 30, 2026, the Ontario Securities Commission (OSC) published its 2026 Annual Service Commitment Review, which sets out the service standards and timelines investors, registrants, and other market participants can expect when interacting with the regulator. According to the OSC press release , the document reflects the OSC's commitment to being an accessible, accountable, and transparent organization, and outlines what stakeholders can expect when dealing with the OSC, how they can help provide high-quality service, and target timelines for various interactions. For complaints or inquiries, the OSC directs market participants and investors to its Inquiries and Contact Centre, which can be reached by phone, email, or online form, while matters related to the Capital Markets Tribunal should be directed to the Tribunal Registrar. When making a filing, the OSC emphasizes that timeliness depends on three factors: the completeness and accuracy of the filing, the complexity of the issues raised, and the speed of the filer's response to inquiries. The OSC also notes that fee waiver requests for System for Electronic Disclosure by Insiders (SEDI) filings, exempt distribution reports, and registration filings are considered on a case-by-case basis. Information about fees is set out in OSC Rule 13 502 Fees and OSC Rule 13-503 (Commodity Futures Act) Fees . Additional guidance can be found in Companion Policy 13-502CP Fees . The changes to the service standards are effective July 1, 2026. The service standards reflect the OSC's commitment to responsiveness and transparency across its regulatory functions, with targets generally set at 80 percent to 95 percent for most activities, meaning the OSC aims to meet these timeframes for the vast majority of cases. For matters that are complex or raise new policy issues, the regulator commits to providing regular touchpoints at a minimum of every two weeks, and any missed targets are reported publicly with explanations. The standards cover areas including general inquiries and complaints, prospectus reviews, exemption applications, registration materials, compliance examinations, continuous disclosure and insider reporting reviews, records requests, and support through the OSC LaunchPad program.

On July 1, 2026, the Department of Internal Affairs (DIA) released a comprehensive suite of Anti-Money Laundering and Countering Financing of Terrorism (AML/CFT) guidance as it assumed responsibility as New Zealand's sole AML/CFT regulator. T he release comprises 23 pieces of new and updated guidance material, representing one of the largest AML/CFT resource releases in recent years. The consolidation of AML/CFT supervision under a single agency aims to provide greater consistency, clearer expectations, and a more streamlined regulatory experience for regulated entities. The guidance covers compliance obligations across multiple areas, including risk assessment, customer due diligence for various entity types (beneficial ownership, companies, trusts, limited partnerships), designated business groups, wire transfers, and prescribed transaction reporting. Additional materials include a guide to complying with the Anti-Money Laundering and Countering Financing of Terrorism Act 2009 , a reporting entity quick start guide, and audit guidance for risk assessment and AML/CFT programmes. The guidance also addresses specific sectors, including clubs and societies, cooperatives, sole traders, and partnerships, alongside materials on outsourcing customer due diligence requirements and reliance on other reporting entities. The DIA will continue publishing further AML/CFT guidance in the coming months and plans to support implementation through webinars, industry outreach, and targeted engagement with reporting entities. All guidance materials are available on the DIA website.

On July 2, 2026, the European Securities and Markets Authority (ESMA) published its final report on the simplification of transaction reporting, outlining recommendations to reduce costs and complexity across EU financial markets. The report identifies potential annual savings of up to €1bn for market participants through the implementation of a "Report Once" approach to transaction reporting. ESMA's analysis identifies fragmentation, duplication, and inconsistent requirements as primary cost drivers. The authority recommends a staged approach combining immediate burden reduction measures with long-term structural reform. At the core of this strategy is the development of a single integrated transaction reporting framework across Regulation (EU) No 600/2014 (Markets in Financial Instruments Regulation – MiFIR), Regulation (EU) No 648/2012 (European Market Infrastructure Regulation – EMIR), and Regulation (EU) 2015/2365 (Securities Financing Transactions Regulation – SFTR), based on a "report once" principle. This integrated model would allow transaction data to be reported once through a common modular structure, with data then reused across authorities and supervisory mandates, reducing duplication while preserving information needed for effective supervision. ESMA's comprehensive cost-benefit analysis indicates the proposed "report once" scenario could deliver annual net savings of €250 million to €1 billion, a reduction in recurring costs of 22 to 24 percent, and 10-year discounted cumulative net benefits of €1.2 billion to €4.9 billion. Alongside long-term reform, ESMA proposes intermediate measures including expanding delegated reporting arrangements, streamlining intragroup exemption procedures, and targeted adjustments to reduce low-value or duplicative reporting requirements. Following publication of the final report, ESMA will engage with EU institutions on the proposed recommendations. Implementation of the integrated approach will require targeted legislative changes, phased implementation, and inclusive dialogue with industry technical experts to coordinate development of reporting templates, data standards, and streamlined infrastructure.

On July 2, 2026, the Australian Securities and Investments Commission (ASIC) cancelled the Australian Financial Services (AFS) licence of Capital Guard AU Pty Ltd (Capital Guard) following an investigation into dishonest conduct and regulatory breaches. ASIC found that Capital Guard engaged in misleading or deceptive conduct, dishonest conduct in connection with its financial services business, and failures in compliance, supervision, and resourcing. ASIC's investigation identified significant misconduct by Capital Guard, including the creation and use of a fake bond prospectus for a non-existent Macquarie Bank bond to solicit investor funds. Capital Guard encouraged and facilitated client investment into this fictitious product, obtaining at least A$100,000 from investors. The firm made misleading statements on its website, misrepresenting its experience and altering third-party scam warnings. Capital Guard also provided false documents to its auditor. Beyond these specific breaches, ASIC identified broader operational failings, including failures to notify ASIC of changes in control, maintain proper accounts and oversight, and maintain adequate resources, competence, and compliance arrangements required to operate as an AFS licensee. The licence cancellation is effective from June 29, 2026 until June 29, 2027 for limited protective purposes, specifically to maintain Capital Guard's membership in the Australian Financial Complaints Authority (AFCA) scheme and to ensure arrangements for compensating retail clients, including professional indemnity insurance cover. Capital Guard may apply to the Administrative Review Tribunal for a review of ASIC's decision. ASIC's investigation into Capital Guard remains ongoing.

On July 2 2026, the Netherlands Gambling Authority (KSA) updated its good and bad practices guidance for conducting affordability assessments. The update follows follow-up compliance testing of how online gambling operators verify that players' gambling behaviour aligns with their financial capacity. Since October 2024, online operators have been required to conduct affordability assessments when players wish to deposit more than €300 net (for players aged 18 to 24 years) or €700 (for players aged 24 and above). The assessment aims to prevent players from spending more on gambling than they can reasonably afford. The KSA first published good and bad practices guidance in February 2025. Subsequently, it conducted follow-up testing with 20 licensed operators, reviewing concrete affordability assessments. The KSA found that many operators improved their affordability assessment procedures following the initial guidance. However, the testing also identified areas for improvement and violations. The KSA applied ten improvement meetings, three warnings, and one binding instruction across various operators. The updated guidance clarifies key requirements based on findings from the compliance testing. Notably, liquid assets such as savings must not form part of the affordability assessment. Assessments must be based solely on the player's structural income. This clarification addresses practical confusion among operators regarding the previous guidance. The KSA emphasised that correct application of affordability assessments remains a priority, as it helps prevent vulnerable players from gambling beyond their means. The authority will continue monitoring operator compliance and conduct further sampling tests among licensed operators based on the updated guidance. The updated good and bad practices guidance is available for download on the KSA website.

On July 2, 2026, the Payment Vision Delivery Committee (PVDC) which comprises representatives of HM Treasury, the FCA, Bank of England and the PSR,  published further context to support stakeholders' reading of the consultation. It covers issues such as how the commercial model for the infrastructure should work and how the new infrastructure can support consumer protection and the fight against financial crime. In this update, PVDC sets out cross‑ HMT and authority thinking to guide engagement with stakeholders in the payment ecosystem on future roles, responsibilities and interactions with respect to the future core infrastructure. This policy paper sits alongside the Retail Payments Infrastructure Board’s (RPIB) Consultation on the Design of the Future Retail Payments Infrastructure, reflecting the close relationship between: the role the core infrastructure will play; and the wider payments ecosystem it supports. It focuses on the future retail payments ecosystem built around the next generation core infrastructure and the payment journeys, schemes and arrangements that sit around it and recognises that the wider ecosystem also includes cards and emerging forms of digital money that may not interact with the core infrastructure. It also recognises that the ecosystem will continue to evolve, including through developments such as open banking and new forms of digital money, and that not all future roles, interactions and dependencies can be known at this stage. It is intended to complement the RPIB Consultation by setting out ecosystem‑level considerations that are relevant to the development of the core infrastructure.

On June 30, 2026, the Gambling Regulatory Authority of Ireland (GRAI) commenced remote betting and betting intermediary licences, marking a significant milestone in Ireland's new gambling regulatory regime. The licences, which took effect on July 1, 2026, cover betting services provided online and by other remote means, including telephone betting, as well as intermediaries facilitating remote betting between parties. In-person betting licences will commence later in 2026. Licensed operators must now comply with strict consumer protection and market integrity obligations under the Gambling Regulation Act 2024. These requirements include age verification to prevent underage gambling, obligations to pay out winnings, prohibitions on facilitating credit or accepting credit cards, and requirements to close accounts on request. The GRAI conducts ongoing compliance monitoring and possesses enforcement powers including investigation, significant sanctions, and action against unlicensed or illegal activity. Anne Marie Caulfield, chief executive of the GRAI, said the licensing application process requires operators to demonstrate they are fit and proper, possess financial capacity to provide gambling activity, and that winnings are funded from lawful means. The GRAI is rolling out licences on a phased basis. Applications for additional licences covering gaming, lotteries, business-to-business services, and charitable and philanthropic gambling will open throughout 2027 and 2028. Minister for Justice Jim O'Callaghan said the commencement establishes a clear and robust regulatory regime, strengthening Ireland's reputation as a well-regulated market.

On July 1, 2026, the Washington Attorney General released the final report from the Washington State Artificial Intelligence Task Force (AI Task Force), concluding two years of work examining artificial intelligence use across the state and recommending policies that balance innovation with protections for civil rights, consumers, and workers. The final report represents the third and final report required by the Legislature, following a preliminary report in December 2024 and an interim report in December 2025. Across all three reports, the AI Task Force has advanced eleven policy recommendations to the Legislature and Governor. During the 2025–2026 legislative biennium, lawmakers introduced legislation addressing eight of the recommendations, with four enacted in whole or in part. These enacted measures regulate companion artificial intelligence chatbots, improve transparency in healthcare prior authorizations, require law enforcement disclosure of artificial intelligence use, and strengthen enforcement against artificial intelligence-generated child sexual abuse material. One of the task force recommendations included in legislation but not enacted into law includes a recommendation to promote responsible governance of high-risk AI systems. According to the task force, high-risk AI systems are artificial intelligence applications that have potential to significantly impact people’s lives, health, safety, or fundamental rights. High-risk AI systems are increasingly being used to make decisions that affect access to critical services, employment eligibility and workplace conditions, access to healthcare and financial services, criminal justice, and public safety, among other things. In its final public meeting on April 24, 2026, the AI Task Force voted to adopt two additional recommendations: establishing a permanent advisory body on artificial intelligence and emerging technology, and regulating companion artificial intelligence chatbots. The Attorney General's Office is releasing the final report alongside two companion documents: an addendum reviewing existing state and federal artificial intelligence regulation, and a survey of Washington workers on artificial intelligence's impact in the workplace.

On July 1, 2026, the Financial Conduct Authority (FCA) published a Policy Statement (PS26/14), finalising fees and levies for the 2026/27 financial year. PS 26/14 contains the 2025/2026 regulatory fees and levies for: The FCA. The Financial Ombudsman Service. PS26/14  also covers the rules that enable us to collect certain levies on behalf of government departments. This document applies to: all FCA fee-payers any businesses considering applying for FCA authorisation or registration Firms can calculate individual fees using the FCA's online fees calculator based on final rates in Appendix 1 of the policy statement.

The Ministry of Finance of Malaysia has issued the Labuan Financial Services and Securities (Amendment) Regulations 2026. The regulations increase the authorisation and supervisory fees for entities licensed under the Labuan Financial Services Authority. The regulations are effective immediately.

On July 2, 2026, the Icelandic Government launched a consultation on proposed amendments to Iceland's virtual asset market regulation . The proposed regulation implements Commission Delegated Regulation (EU) 2024/1504 which specifies the procedural rules for the exercise of the power to impose fines or periodic penalty payments by the European Banking Authority on issuers of significant asset-referenced tokens (ARTs) or significant e-money tokens (EMTs). The Icelandic government is seeking feedback on its consultation by July 10, 2026, which may be submitted via this link .

On June 29, 2026, the National Bank of Ukraine (NBU) suspended the licence of Svit Finansiv due to consumer protection failures. The NBU found that the company was carrying out risky activities that threatened the interests of their clients and creditors. In particular, activities to provide funds to other persons under the terms of a repayable financial assistance agreement with the right to provide lending services and carry out transactions (directly or indirectly) that did not have economic feasibility.

On July 1, 2026, the Central Bank of Russia (CBR) published an information notice on the specifics of reporting information in Form 0420011, applicable to investment firms and management companies. When preparing Subsection 1.2 of Section 1 and Subsection 2.2 of Section 2 of the Form 0420011 report “Report on Cash Transactions of Insurance Organisations, Mutual Insurance Companies, Foreign Insurance Organisations, Insurance Brokers, Investment Platform Operators, Non-State Pension Funds, Management Companies of Investment Funds, Unit Investment Funds, and Non-State Pension Funds”, as established in Appendix 1 to Directive No. 6789-U1, using the CBR’s XBRL taxonomy (version 7.1)² to specify information relating to the country code of the place of registration of non-resident clients of the reporting organisation with respect to stateless individuals, the analytical attribute “999” of the analytical attribute group “Country Code”.

On June 30, 2026, the Central Bank of Russia (CBR) announced planned enhancements to its regulation of market risk for credit institutions. The changes expand banks' ability to use domestic ratings for more precise market risk assessment, enabling them to optimise capital requirements. The regulatory modifications will affect a broad range of debt securities held in banks' trading portfolios, including securitisation instruments, bonds issued by Russian corporate entities, foreign sovereigns and subjects of the Russian Federation. The CBR is also introducing a more risk-sensitive approach to assessing commodity derivatives. Suggestions and feedback are welcome up until July 14, 2026 and can be sent via email to CRRiRL@cbr.ru .

On June 29, 2026, the Central Bank of Russia (CBR) published the Bank of Russia Guidelines on Business Continuity Risk Management in Credit Institutions and Banking Groups. To ensure the operational resilience of an institution, it is recommended to define the following in internal documents: Principles for ensuring operational resilience. Procedures for identifying business continuity risk. A procedure for collecting and recording information on business continuity risk events. The procedure for responding to identified business continuity risk events and restoring mission-critical processes. The procedure for monitoring business continuity risk. Threshold and monitoring values for business continuity risk indicators. Measures and procedures for raising awareness, training and developing the skills of employees of a credit institution. These guidelines are not mandatory, but credit institutions should use them as a benchmark.

On July 1, 2026, Sweden's central bank, Riksbanken, expanded offline card payment capabilities for purchases of essential goods. The measure strengthens the resilience of Sweden's payment system and follows an agreement reached in October 2025 between Riksbanken and market participants including card issuers, card networks, acquirers, retailers and fuel companies. The expanded offline functionality applies to most Visa and Mastercard cards issued to individuals over 18 years old by participating card issuers. Cardholders can now use physical cards with personal identification numbers to purchase essential items, including groceries, medicines and fuel at staffed stations, when data communication is unavailable due to severe disruptions, cyberattacks, peacetime crises or heightened alert status. The measure aims to significantly increase preparedness by ensuring card payments function during communication outages. The participating card issuers are Danske Bank, Handelsbanken, Ica Banken, Länsförsäkringar Bank, Nordea, SEB and Swedbank. Card networks Visa and Mastercard support the functionality, alongside acquirers Adyen, Nets, Swedbank Pay and Worldline. Riksbanken encourages additional banks and card issuers to join the agreement to further strengthen Sweden's payment preparedness. As a next step, Riksbanken has initiated work with Getswish and relevant companies to explore offline functionality for the Swish payment service during 2026.

On July 2, 2026, Denmark's Financial Supervisory Authority (FSA) published guidance addressing reporting errors by banks in calculating risk weights for real estate exposures under new Capital Requirements Regulation (CRR3) rules that took effect in January 2025. The FSA's review identified that multiple institutions had incorrectly reported risk weights for real estate exposures under the standardised approach for credit risk. The new CRR3 framework introduced two additional exposure classes: Income Producing Real Estate (IPRE); and Acquisition, Development and Construction (ADC) exposures. The FSA found that institutions primarily struggled with correctly classifying these new exposure categories. Root causes included insufficient system solutions from data service providers, inadequate manual corrections to system-generated calculations, insufficient business processes and controls, and incomplete knowledge of the new definitions, particularly regarding ADC exposures. Although the FSA's review did not result in supervisory actions, the errors in some cases led to underestimation of risk-weighted exposures. The FSA identified several remedial measures that institutions have implemented to ensure accurate reporting. These include developing formal business procedures for registering, monitoring and controlling ADC and IPRE exposures: Updating system solutions in coordination with data service providers. Centralising ADC classification within credit departments with manual assessment during the approval process. Implementing continuous monitoring and staff training on correct registration. Adopting conservative classification approaches where uncertainty exists. The FSA emphasised that accurate calculation and reporting of risk-weighted real estate exposures is critical, as errors risk incorrect decision-making and underestimation of capital requirements. The FSA expects the European Banking Authority (EBA) to provide further clarification on ADC exposure definitions through guidance to ensure clear classification boundaries.

On June 30, 2026, South African government, published a notice amending the regulations relating to banks under section 90 of the Banks Act, 1990 (Act No. 94 of 1990) , with effect from July 1, 2026. The amendment makes the following changes to regulation 30 of the Regulations relating to Banks: Subregulation (1) is replaced with a simplified provision requiring banks to complete form BA 330 in accordance with instructions or requirements as determined or directed in writing by the Prudential Authority. Subregulations (2) to (10), which previously contained detailed IRRBB requirements, are deleted in their entirety, with those requirements transferred into Directive 3 of 2026 issued by the Prudential Authority on the same date.

On June 30, 2026, Saudi Arabia's Capital Market Authority (CMA) announced its Board's decision permitting listed joint-stock companies on the Saudi Exchange (Tadawul) to early adopt International Financial Reporting Standard No. 18 (IFRS 18) "Presentation and Disclosure in Financial Statements" during 2026. IFRS 18 was issued by the International Accounting Standards Board (IASB)and locally adopted by the Saudi Organisation for Chartered and Professional Accountants (SOCPA) in 2024. The standard enhances requirements for presentation and disclosure covering the statement of financial performance, aggregation and disaggregation principles, and management-defined performance measures. Mandatory application commences for financial periods beginning on or after January 1, 2027. Key points include: Listed companies that early adopt IFRS 18 during 2026 must announce their IFRS 18-prepared financial statements and the effect of early adoption on the Tadawul website, whilst continuing to prepare approved financial statements under IAS 1 and publishing them through the Exchange's designated electronic systems to fulfil statutory disclosure requirements. Listed companies must continue preparing approved financial statements in accordance with IAS 1 until mandatory application of IFRS 18 commences on January 1, 2027. For interim and annual financial statements covering periods beginning on or after April 1, 2026, listed companies must disclose a preliminary assessment of the expected impact of the initial application of IFRS 18. Boards of directors are required to continuously monitor progress toward compliance with IFRS 18 ahead of its mandatory effective date. Listed companies must comply with paragraphs (c) and (d) of Article 66 of the Rules on the Offer of Securities and Continuing Obligations, as amended by CMA Board Resolution No. 3-6-2026 dated January 19, 2026.

On July 1, 2026, the Cyprus Securities and Exchange Commission (CySEC) issued Circular No. C787 requiring all Cyprus Investment Firms (CIFs) authorised by June 30, 2026 to submit quarterly statistics using Form QST-CIF (Version 19) for the quarter ending June 30, 2026. The updated Form QST-CIF (Version 19) introduces a new Section P (Part I) requiring CIFs to report customers subject to international sanctions, mirroring Section Q of the Form RBSF-CIF. CIFs must complete and electronically submit the form via CySEC's Transaction Reporting System (TRS) by August 4, 2026. CIFs that fail to comply face administrative penalties under sSction 37(5) of the CySEC Law, and CySEC will not send reminders to non-compliant firms.

In a decision dated June 23, 2026, the French Financial Markets Authority’s (AMF) Enforcement Committee imposed a fine of €800,000 Bourse Direct, an investment services provider, for failure to report transactions to the AMF. The Enforcement Committee found that Bourse Direct failed to report transactions to the AMF between January 1, 2021 and November 30, 2023. Specifically, the firm did not report transactions carried out by its trading desk and those executed on behalf of a bank's clients, representing 0.58 percent of all transactions during the inspection period. The committee also determined that Bourse Direct's system for monitoring and detecting market abuse was ineffective, and that it had failed to conduct regular assessments of its market abuse detection system and had not updated it despite identifying the need for an update. The AMF also imposed a fine against one of the firm's directors.

On July 1, 2026, the Commission de Surveillance du Secteur Financier (CSSF) published guidance to market participants on the application of Regulation (EU) 2024/3005 (ESG Ratings Regulation). The ESG Ratings Regulation introduces a new disclosure requirement under Article 49, which amends Article 13 of Regulation (EU) 2019/2088 on sustainability‐related disclosures in the financial services sector (SFDR). When financial market participants and financial advisers subject to the SFDR issue and disclose ESG ratings to third parties as part of their marketing communications, they must include on their website the same information required by point 1 of Annex III of the ESG Ratings Regulation. Financial market participants and financial advisers must also disclose a link to these website disclosures within their marketing communications. The CSSF expects full compliance with the provisions from July 2, 2026 onwards.

On July 1, 2026, Czech Republic's Ministry of Industry and Commerce introduced a draft law establishing cybersecurity requirements for products with digital elements. The proposed law aims to transpose the European Union's Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for digital products (Cyber Resilience Act) into Czech law. The Cyber Resilience Act (CRA) introduces mandatory cybersecurity requirements for manufacturers, covering the planning, design, development and maintenance of hardware and software products. The draft law includes the following measures: Defines institutional arrangements for supervising the security of digital products. Designates a notifying body responsible for managing compliance procedures. Establishes obligations for notified conformity assessment bodies and sets out procedures for reporting on digital product security. Specifies administrative offences and penalty amounts for breaches of cybersecurity obligations by economic operators and notified conformity assessment bodies. The draft law is currently in the comment procedure stage of the legislative process.

On July 1, 2026, the Malta Financial Services Authority (MFSA) issued a circular addressing the transposition of Commission Delegated Directive (EU) 2026/374 into the Conduct of Business Rulebook (COBR). The directive, which came into force on June 6, 2026, updates the Markets in Financial Instruments Directive II (MiFID II) framework governing how investment firms obtain and pay for third-party research and execution services. The directive introduces five key changes applicable to investment firms in Malta: It permits flexibility in payment models, allowing firms to pay for research and execution separately (unbundled) or jointly (bundled), removing previous restrictions such as small and medium-sized enterprise (SME)-only bundling thresholds under MiFID II. It strengthens quality and governance requirements, mandating that investment firms conduct annual research quality assessments evaluating value, usefulness and contribution to investment decisions, with firms responsible for remedial actions where quality is inadequate. It enhances rules for research payment arrangements, requiring firms that use research payment accounts or structured payments to establish predefined budgets, maintain strong internal controls and compile clear audit trails, while prohibiting the linking of research costs to transaction volumes. It maintains investor protection safeguards, ensuring investment firms continue to comply with best-execution, conflict-of-interest rules and fiduciary duties. It upholds transparency requirements, obligating firms to disclose to clients whether research and execution are paid jointly or separately and how costs are structured. The MFSA has amended COBR Rules R.3.49 to R.3.56 to reflect these requirements. Investment firms are encouraged to update their processes to comply with the directive's requirements, which take effect immediately. The amendments to the COBR take effect immediately.

The Securities and Exchange Board of India (SEBI) has issued a consultation paper on rationalizing the requirement of obtaining investor consent and the ambit of conflicted transactions under the SEBI (Alternative Investment Funds) Regulations, 2012. The consultation paper contains: New definitions proposing to introduce the term "related party" into the AIF Regulations, borrowing the definition from Section 2(76) of the Companies Act, 2013, to replace the narrower term "associate" specifically in the context of conflicted transactions. Principles prescribing a standardized consent threshold, proposing to bring consistency by requiring a 75 percent unitholder approval (by value) for all material changes and conflicted transactions where a two-thirds majority is currently mandated. Specific rules mandating the modalities for seeking investor consent, requiring AIFs to consistently follow a chosen methodology at the fund level and explicitly disclose it in their Private Placement Memorandums (PPMs). Provisions outlining three proposed options for AIFs to calculate investor consent: "Deemed consent," "Present and voting," and "Express voting for approval," allowing managers operational flexibility while ensuring investor protection. Administrative measures detailing the responsibility of the AIF manager to ensure transparency, provide equal voting opportunities to all investors regardless of the chosen methodology, and maintain comprehensive records of all communications, meetings, and votes. Directives to exclude transactions with related parties of the AIF's trustees, Board of Directors, or designated partners from the ambit of conflicted transactions that require investor consent, recognizing their limited role in day-to-day fund operations. Feedback may be submitted via this link by July 21, 2026

On July 1, 2026, the European Union Agency for Cybersecurity (ENISA) launched a survey for the NIS360 2027 report, following publication of the 2026 edition in May 2026. The agency is inviting both national authorities and high criticality entities operating under Directive (EU) 2022/2555 (Network and Information Systems 2 Directive – NIS2) to participate in structured questionnaires designed to assess cybersecurity maturity across critical sectors. The NIS360 survey combines insights from the private sector with perspectives from national authorities to evaluate sectoral cybersecurity maturity and criticality. ENISA is seeking feedback on its survey by October 30, 2026, which may be submitted via this link .

On July 1, 2026, the European Securities and Markets Authority (ESMA) issued a public statement addressing the publication and distribution of environmental, social and governance (ESG) ratings by third parties during the transitional period preceding formal authorisation under Regulation (EU) 2024/3005 (ESG Ratings Regulation – ESGRR). The statement provides guidance to market participants on permissible activities for ESG rating providers operating in the European Union during the interim period from July 2, 2026, until such providers obtain authorisation or recognition. ESMA clarifies the regulatory framework governing ESG ratings distribution and establishes expectations for third-party rating providers during this transitional phase. The statement addresses compliance obligations and operational requirements for entities engaged in publishing or distributing ESG ratings to market participants and investors across the EU. This guidance is significant for ESG rating providers, asset managers, financial institutions, and other market participants that rely on or distribute ESG ratings.

The Reserve Bank of India (RBI) has issued the Reserve Bank - Integrated Ombudsman Scheme (RB-IOS), 2026. The scheme aims to provide a cost-effective, expeditious, and non-adversarial alternate grievance redress mechanism for resolving customer complaints against regulated entities. The enacted scheme contains: New definitions for key terms, including "Appellate Authority," "Authorised Representative," "Award," "Complaint," "Deficiency in service," "RBI Ombudsman," and "Rejected Complaints". Regulations prescribing the scope and application of the scheme, specifying that it applies to commercial banks, regional rural banks, state and central co-operative banks, scheduled and non-scheduled primary (urban) co-operative banks (with a deposit size of INR 50 crore (US$5,280,003) and above). It also applies to specific non-banking financial companies (with an asset size of INR 100 crore (US$10,560,007) and above), non-bank prepaid payment instrument issuers, and credit information companies. Specific rules mandating the grounds for maintainability of a complaint, stipulating that a complainant must first file a written complaint with the regulated entity. The complaint to the RBI Ombudsman is only maintainable if the complainant receives no reply within 30 days (or the time specified by relevant guidelines), or is dissatisfied with the reply, and the complaint is filed within 90 days of that timeline expiring or the last communication. Provisions outlining the powers of the RBI Ombudsman, granting them the authority to facilitate settlements, pass awards, and provide compensation up to INR 30 lakh (US$31,680) for consequential loss and up to INR 3 lakh (US$3,168) for harassment, mental anguish, or expenses incurred. Administrative measures detailing the procedure for resolving complaints, establishing a Centralised Receipt and Processing Centre for online , email, or physical submissions. The proceedings are summary in nature, and if a regulated entity fails to file a written response within 15 days, the Ombudsman may proceed ex-parte. Directives requiring regulated entities to appoint a Principal Nodal Officer at their head office to represent the entity. Entities must also prominently display the salient features of the scheme and the contact details of the Principal Nodal Officer at their branches and on their websites. The scheme takes immediate effect.

On July 1, 2026, the European Securities and Markets Authority (ESMA) launched a consultation on technical advice to the European Commission (EC) regarding selected key performance indicators (KPIs) under Commission Delegated Regulation (EU) 2021/2139 (Taxonomy Disclosures Delegated Act). The consultation focuses on simplification and reduction of reporting burdens for market participants, building on recent simplification efforts under the Commission's Omnibus package and supporting the broader review of Taxonomy reporting. ESMA proposes several simplifications to the Taxonomy disclosure framework for non-financial undertakings and asset managers. The proposals address the operational expenditure KPI (OpEX), responding to stakeholder concerns about complexity and reporting burden. ESMA is seeking feedback on its consultation by August 12, 2026, which can be submitted via this link .

On July 1, 2026, the European Banking Authority (EBA) published a Discussion Paper on key performance indicators (KPIs) and other aspects of Commission Delegated Regulation (EU) 2021/2178 (Disclosures Delegated Act) under Article 8 of Regulation (EU) 2020/852 (Taxonomy Regulation – TR). The consultation aims to simplify and enhance the usability of information disclosed by credit institutions and investment firms regarding their alignment with sustainable finance taxonomy requirements.  The Discussion Paper outlines preliminary proposals to simplify the Fees and Commission KPI, Trading Book KPI, and Off-balance sheet exposures KPI for credit institutions; simplify the 'other services' KPI for investment firms; clarify and improve group-level disclosures, including those by parent undertakings; and address the treatment of operational expenditure KPI disclosed by non-financial undertakings in calculating financial undertakings' KPI. The EBA is seeking feedback on its consultation by August 12, 2026, which may be submitted via this link .

On July 1, 2026, the Norwegian government published the Regulations amending the Regulations on financial undertakings and financial groups . The amendment introduces new provisions in Part VII of Chapter 16 regarding confidentiality and personal data processing. The amendment expands the scope of information that financial undertakings may disclose under the Financial Undertakings and Financial Groups Act . Financial undertakings may now share information obtained through customer due diligence measures conducted under the Money Laundering Act . The regulation applies to all financial undertakings operating in Norway and becomes effective on July 1, 2026.