Regulatory Updates 2026

What Changed

• - Large associations, associations recognised as being of public utility and foundations are now subject to the accounting regime applicable to “medium‑sized undertakings” under the amended...
• Annual accounts for affected entities must include a non‑abridged balance sheet, a profit and loss account (at least in abridged format), and notes to the accounts containing disclosures required by...
• Affected entities must use statutory LRCS layouts for the balance sheet and profit and loss account and file their annual accounts in classic format with the Luxembourg Trade and Companies Register...
• Large associations, public‑utility associations and foundations remain exempt from the mandatory use of the Standard Chart of Accounts (Plan Comptable Normalisé – PCN) and from eCDF standard data...
• Affected entities may voluntarily adopt the PCN; if they do not adopt PCN, they must maintain an internal chart of accounts and ensure robust, documented mapping between internal accounts and...

Suggested Considerations

• Identify all Luxembourg associations, public‑utility associations and foundations within or related to the group that are impacted by the Law of 7 August 2023 and confirm their size classification (small, medium‑sized, large) and whether they fall under the “medium‑sized undertakings” regime.
• Review existing accounting policies, charts of accounts and annual accounts formats for affected entities to ensure alignment with LRCS statutory layouts, including non‑abridged balance sheet, appropriate profit and loss format, and required notes disclosures.
• Decide at governing‑body level whether each affected entity will voluntarily adopt the PCN or maintain an internal chart of accounts, documenting the rationale, governance approvals and compliance impacts of the chosen option.
• Where PCN is not adopted, design, implement and document a robust mapping from the internal chart of accounts to the statutory LRCS balance sheet and profit and loss layouts, ensuring audit‑ready documentation and traceability.
• Update accounting systems and reporting tools for affected entities to support LRCS statutory layouts, consistent layout adaptations, and classic‑format filing with the RCS, including necessary changes to interfaces and data capture.

Key Dates

References

• [1] cnc.lu/en/publication-of-qa-cnc-26-038/
• [2] linkedin.com/posts/stephane-schirrecker-6b52912_new-qa-cn...
• [3] cssf.lu/en/2026/06/cssf-communique-concerning-certain-cnc...
• [4] cssf.lu/en/
• [5] cnc.lu/en/publication-of-non-financial-information-and-di...
• [6] cssf.lu/wp-content/uploads/cssf18_698eng.pdf
• [7] cssf.lu/en/regulatory-framework-for-investment-fund-manag...
• [8] cssf.lu/en/2023/06/publication-of-qas-by-the-commission-d...

What Changed

• - Large not‑for‑profit associations, associations recognised as being of public utility and foundations are required to prepare annual accounting documents consisting at a minimum of annual accounts...
• These entities fall within the regime applicable to “medium‑sized undertakings”, which drives the required content and level of detail of their annual accounts (balance sheet, profit and loss account...
• The law and the CNC Q&A confirm that large associations, public‑utility associations and foundations are not legally required to use the Standard chart of accounts (Plan comptable normalisé, PCN) or...
• Although exempt from mandatory PCN use and eCDF standard data collection, these entities must still file their annual accounts with the Luxembourg Trade and Companies Register (RCS) using statutory...
• Large associations, public‑utility associations and foundations are exempt from the obligation to file the PCN trial balance (balance générale) via the eCDF platform, even though they may still...

Suggested Considerations

• Identify whether the organisation qualifies as a large association, an association recognised as being of public utility or a foundation under the Law of 7 August 2023, and document the classification decision with reference to Articles 18, 36 and 52 of that law.
• Update internal accounting policies to require annual accounts to be prepared in accordance with the regime for undertakings referred to in Article 47 LRCS, including minimum content (balance sheet, profit and loss account and notes) and disclosure requirements.
• Decide formally whether to adopt the PCN on a voluntary basis or to maintain an internal chart of accounts, and record this decision in accounting governance documents approved by the board or governing body.
• Where PCN is not adopted, design and implement a detailed and documented mapping from internal general ledger accounts to LRCS statutory balance sheet and profit and loss layouts to ensure accurate preparation and filing of annual accounts.
• Review and, where necessary, redesign annual accounts templates to comply with LRCS layouts while making only permitted adaptations (for example, titles and subtotals) that maintain clarity, comparability and consistency over time.

Key Dates

References

• [1] cnc.lu/en/publications/doctrine/qa-cnc-26-038-large-assoc...
• [2] cnc.lu/en/publication-of-qa-cnc-26-038/
• [3] cnc.lu/publications/doctrine/qa-cnc-26-038-grandes-associ...
• [4] cnc.lu/publication-du-qa-cnc-26-038/
• [5] cssf.lu/en/
• [6] linkedin.com/posts/stephane-schirrecker-6b52912_new-qa-cn...
• [7] cssf.lu/en/2026/06/cssf-communique-concerning-certain-cnc...
• [8] cssf.lu/en/publication-data/

What Changed

• - Counterparties whose average aggregate notional amount (AANA) of non-centrally cleared OTC derivatives falls below the EUR 8 billion threshold will no longer be required to exchange initial margin...
• The current framework, under which below-threshold counterparties are exempt from initial margin for new trades but must continue to exchange initial margin for pre-existing “legacy” contracts, will...
• Article 28(1) of Delegated Regulation (EU) 2016/2251 will be amended to explicitly extend the exemption from initial margin requirements to outstanding contracts where one of the two counterparties...
• The RTS introduce a clearer operational framework for entry into and exit from the initial margin regime based on the annual AANA calculation for March–May, including scenarios where one or both...
• Once a counterparty falls below the EUR 8 billion threshold under the revised rules, firms will be permitted to terminate related initial margin processes, including ceasing ongoing calculation,...

Suggested Considerations

• Map all EMIR in-scope entities within the group and identify those whose AANA of non-centrally cleared OTC derivatives is close to or below the EUR 8 billion threshold, to assess which relationships may benefit from the expanded exemption.
• Review current collateral and margin frameworks to identify legacy contracts where initial margin is still being exchanged solely because the regime requires continuation despite the counterparty having fallen below the EUR 8 billion threshold.
• Prepare an internal policy update so that, once the RTS enter into force, initial margin requirements are switched off for counterparties below the EUR 8 billion threshold on both new and existing uncleared OTC derivatives, subject to group risk appetite.
• Update EMIR margin procedures and AANA calculation processes to ensure accurate annual determination of whether each counterparty is above or below the EUR 8 billion threshold, including documentation of the March–May calculation methodology.
• Review and amend collateral agreements, credit support annexes (CSAs) and associated legal documentation to incorporate the revised treatment for below-threshold counterparties, including terms for stopping margin exchange and potentially releasing segregated collateral.

Key Dates

References

• [1] esma.europa.eu/press-news/esma-news/joint-rts-amendments-...
• [2] esma.europa.eu/sites/default/files/library/esas_2019_20_-...
• [3] esma.europa.eu/document/emir-rts-various-amendments-bilat...
• [4] esma.europa.eu/sites/default/files/2026-08/ESA_2026_07_Fi...
• [5] esma.europa.eu/press-news/consultations
• [6] ashurst.com/en/insights/financial-services-speedread-4-au...
• [7] esma.europa.eu/press-news/esma-news/esas-publish-joint-qa...
• [8] sip.lex.pl/komentarze-i-publikacje/poradniki/sprawozdanie...

What Changed

• - The EDMC now has a new Chair (Nicholas Segal) and Deputy Chair (Peter King), replacing Sir William Blair and Philip Marsden whose terms ended in July 2026.
• The appointments are the outcome of an external recruitment process commenced in October 2025, aligned with the EDMC’s governance framework and five‑year renewable term structure.
• The scope of the EDMC’s remit continues to cover contested enforcement decisions across the Bank’s statutory regimes: Prudential Regulation, Financial Market Infrastructures, Resolution,...
• The EDMC Procedures, published in January 2024, remain the operative framework for how contested enforcement cases are handled, including panel constitution, hearing processes, and decision‑making...
• The EDMC continues to operate with functional separation from investigation teams and the Bank’s executive, preserving independence in contested enforcement decisions.

Suggested Considerations

• Map all existing and potential enforcement exposures to the EDMC’s statutory remit, covering prudential regulation, FMI, resolution, securitisation, wholesale cash distribution, critical third parties and notes issuance.
• Review internal enforcement‑response playbooks to ensure they explicitly recognise the EDMC’s independent role and the January 2024 EDMC Procedures, including how contested cases will be heard and decided.
• Update board and senior management briefings on BoE/PRA enforcement to reflect the change in EDMC leadership and likely implications for contested case strategy and settlement versus contest decisions.
• Assess ongoing and anticipated enforcement matters for which the firm might contemplate contesting; incorporate the EDMC’s composition and procedures into litigation and regulatory strategy planning.
• Train Legal, Compliance and relevant business teams on the practical implications of the EDMC Procedures (panel size, hearing processes, written and oral representations, decision timelines) with scenario‑based exercises for contested cases.

Key Dates

References

• [1] bankofengland.co.uk/prudential-regulation/publication/202...
• [2] finreg.aoshearman.com/Bank-of-England-Establishes-Enforce...
• [3] 3vb.com/sir-william-blair-appointed-chair-of-bank-of-engl...
• [4] bankofengland.co.uk/about/people/court-of-directors/gover...
• [5] mondovisione.com/media-and-resources/news/bank-of-england...
• [6] elischolar.library.yale.edu/cgi/viewcontent.cgi?article=1...
• [7] talents.studysmarter.co.uk/companies/the-bank-of-england/...
• [8] treasury.govt.nz/sites/default/files/2018-04/rbnz-rev-ban...

What Changed

• - Introduces principles‑based requirements for vertically integrated market structures involving affiliations between derivatives clearing organizations, designated contract markets, swap execution...
• Amends Part 37 to set additional governance, conflict‑management, and structural requirements for swap execution facilities where the SEF is affiliated with an intermediary or trading entity.
• Amends Part 38 to impose enhanced conflict‑of‑interest and self‑regulatory safeguards for designated contract markets that are affiliated with futures commission merchants or proprietary trading...
• Amends Part 39 to clarify and strengthen requirements on derivatives clearing organizations in group structures where the DCO is affiliated with intermediaries or other market participants, including...
• Amends regulation 1.52 (accounts and records; FCM supervisory requirements) to reflect the heightened expectations placed on futures commission merchants that are part of vertically integrated...

Suggested Considerations

• Identify and map all affiliate relationships involving CFTC‑regulated entities within your group (DCO, DCM, SEF, FCM, SD/MSP, trading entities, market makers) and document how roles and control relationships could create actual or perceived conflicts of interest.
• Conduct a gap analysis of existing governance, conflicts‑of‑interest, information‑barrier, and supervision frameworks against the anticipated principles‑based expectations for vertically integrated structures under Parts 37, 38, 39 and regulations 1.52 and 1.55.
• Review and, where necessary, enhance board‑level and committee‑level oversight arrangements for affiliated entities to ensure independent decision‑making on listing, clearing, rule enforcement, membership, and client treatment where affiliates are involved.
• Assess current customer risk disclosures, including those required under regulation 1.55 for FCMs, to determine whether affiliate relationships and related conflicts are adequately described, and prepare draft revisions that could be implemented if the new requirements are finalized.
• Engage legal, compliance, and business stakeholders for each affected entity (DCO, DCM, SEF, FCM, trading entity) to prepare a coordinated comment letter to the CFTC explaining operational impacts, potential unintended consequences, and recommendations on specific rule language.

Key Dates

References

• [1] cftc.gov/PressRoom/PressReleases/9274-26
• [2] reginfo.gov/public/do/eAgendaViewRule?pubId=202404&RIN=30...
• [3] cftc.gov/LawRegulation/DoddFrankAct/Dodd-FrankProposedRul...
• [4] comments.cftc.gov/FederalRegister/Proposed.aspx?Type=List...
• [5] public-inspection.federalregister.gov/2023-28745.pdf
• [6] content.next.westlaw.com/practical-law/document/If6afd4b4...
• [7] public-inspection.federalregister.gov/2012-00935.pdf?1329...
• [8] cftclaw.com

What Changed

• - The Supplemental Guidance formally sets out the circumstances and general principles the CBI’s Prohibition Decision Maker will consider when deciding whether to impose a Prohibition Notice,...
• The guidance clarifies the decision-making framework for the nature, scope and duration of a prohibition, including whether it applies to specific controlled functions (CFs), parts of CFs, or any...
• The guidance codifies how a Prohibition Notice becomes effective, establishing that effectiveness arises either through a written agreement between the CBI and the individual concerned (prohibition...
• The guidance explains the three mechanisms by which a Prohibition Notice may be terminated or cease to have effect: (1) termination of a prohibition agreement by the CBI, (2) revocation of a...
• The Supplemental Guidance sets out CBI’s approach to requests by prohibited persons to terminate a prohibition agreement, including the factors CBI will assess when considering whether to lift or...

Suggested Considerations

• Update Fitness and Probity policies, procedures, and governance frameworks to explicitly address the possibility of Prohibition Notices, including criteria for escalation, internal investigation standards, record‑keeping, and engagement protocols with the CBI during prohibition-related processes.
• Ensure Board and senior management, including PCF role holders and HR/legal/compliance leads, are briefed on the new prohibition guidance, the publication policy, and the enhanced transparency of outcomes so that they understand the personal and organisational consequences of F&P failings.
• Strengthen documentation and retention of supervisory, disciplinary, compliance and performance records for CF and PCF holders to ensure that, if a prohibition is contemplated, the firm can provide a coherent, contemporaneous factual record to the CBI and the individual.
• Review and, where necessary, amend individual accountability frameworks (including Statements of Responsibilities and role profiles) to clearly delineate responsibilities, seniority and CF scope, given that these factors now explicitly influence the nature, scope and duration of any prohibition.
• Embed procedures to manage individuals who become subject to proposed or actual Prohibition Notices, including immediate role restrictions, notification workflows, communication protocols to boards and key stakeholders, and contingency planning for business continuity.

Key Dates

References

• [1] centralbank.ie/regulation/how-we-regulate/fitness-probity
• [2] centralbank.ie/docs/default-source/regulation/how-we-regu...
• [3] centralbank.ie/docs/default-source/regulation/how-we-regu...
• [4] centralbank.ie/regulation/how-we-regulate/fitness-probity...
• [5] cgi.org.uk/membership/branches-regions/ireland/agenda/iri...
• [6] maples.com/wp-content/uploads/2025/04/Central-Bank-of-Ire...
• [7] centralbank.ie/docs/default-source/regulation/how-we-regu...
• [8] maples.com/knowledge/updates-to-the-irish-fitness-and-pro...

What Changed

• - Issuers domiciled in Germany with securities admitted to trading on an organised market in Germany must publish an announcement (“Hinweisbekanntmachung”) specifying the exact date and internet...
• The announcement on annual financial information must be published no later than four months after the end of each financial year and must be issued before the first public availability of the...
• Annual financial information must be made publicly available on the internet in addition to its disclosure in the Company Register (Unternehmensregister), and the announcement obligation relates...
• Issuers must publish a half‑yearly financial report no later than three months after the end of each reporting period.
• Failure to publish financial reports or the required announcements, or failure to do so within the prescribed periods, constitutes a contravention of the WpHG and exposes the issuer to administrative...

Suggested Considerations

• Map all WpHG‑related periodic reporting obligations (annual, half‑yearly, and any interim or ad‑hoc requirements) into a documented compliance calendar with responsible owners and system reminders well ahead of statutory deadlines.
• Implement a formal procedure to prepare, approve, and publish “Hinweisbekanntmachungen” that clearly specify the date and internet address of annual financial information, ensuring publication before the first public availability of the annual report and within four months of financial year‑end.
• Establish controls to guarantee that annual financial information is published both in the Company Register and on the issuer’s website, and that these publications are synchronised with the required announcements.
• Design and enforce a process for producing and publishing half‑yearly financial reports within three months after the end of each reporting period, including clear timelines for drafting, audit/review (where relevant), management approval, and technical website publication.
• Conduct a gap analysis of current financial reporting and disclosure procedures against WpHG requirements to identify any missing steps, unclear responsibilities, or weaknesses in escalation mechanisms for imminent deadline breaches.

Key Dates

References

• [1] bafin.de/SharedDocs/Veroeffentlichungen/DE/Massnahmen/40c...
• [2] bafin.de/SharedDocs/Downloads/DE/Angebotsunterlage/Leo_In...
• [3] bafin.de/EN/home_node_en.html
• [4] northdata.com/Leo%20International%20Precision%20Health%20...
• [5] finanznachrichten.de/nachrichten-2026-03/68026196-leo-int...
• [6] globenewswire.com/news-release/2026/05/22/3300302/0/en/le...
• [7] globenewswire.com/news-release/2026/06/12/3311244/0/en/le...

What Changed

• - The PRA finalises amendments to the Reporting Part of the PRA Rulebook to implement post‑implementation clarifications, consistency improvements and data quality enhancements to Solvency UK...
• Reporting and disclosure templates and instructions are amended (including XBRL taxonomy changes) to reflect the refined Solvency UK reporting framework and consequential changes from the Own Funds...
• The PRA confirms transfer of the Matching Adjustment Asset and Liability Information Return (MALIR) templates from Excel to XBRL submission format, to be incorporated into the single insurance...
• The PRA updates Supervisory Statement 7/18 – Solvency II: Matching adjustment, including changes to the Matching Adjustment supplementary information form under Insurance rule permissions and...
• The PRA introduces a new collection of projected Financial Services Compensation Scheme (FSCS) liabilities data from third‑country branch undertakings to support enhanced branch supervision.

Suggested Considerations

• Review and map existing Solvency UK reporting processes, systems and controls against the amended Reporting Part of the PRA Rulebook and updated templates and instructions to identify required changes for year‑end 2026.
• Engage with finance, risk and actuarial functions to implement the new XBRL‑based MALIR submission process, including testing data extraction, validation and filing workflows aligned to the updated insurance taxonomy.
• Update internal Own Funds policies, classification procedures and governance documentation to reflect removal of specified permission requirements and the amended Own Funds Part and Group Supervision Part of the PRA Rulebook.
• Reconfigure regulatory reporting infrastructure and vendor solutions to adopt the single updated PRA insurance XBRL taxonomy, ensuring all Solvency UK quantitative reporting templates and narrative disclosures are correctly mapped and validated.
• For third‑country branch undertakings, design and implement processes to calculate and report projected FSCS liabilities data in line with PRA expectations, including data sourcing, modelling assumptions and internal review controls.

Key Dates

References

• [1] bankofengland.co.uk/prudential-regulation/regulatory-repo...
• [2] skadden.com/insights/publications/2025/10/chapter-9-solve...
• [3] bankofengland.co.uk/prudential-regulation/key-initiatives...
• [4] bankofengland.co.uk/prudential-regulation/publication/202...
• [5] nortonrosefulbright.com/en/knowledge/publications/8dc8438...
• [6] bankofengland.co.uk/-/media/boe/files/prudential-regulati...
• [7] bankofengland.co.uk/prudential-regulation/publication/202...
• [8] bankofengland.co.uk/prudential-regulation/publication/202...

What Changed

• - Lloyd’s syndicates would be removed from the scope of Internal Model Output (IMO) reporting to the PRA via amendments to SS25/15 (Solvency II: Regulatory reporting, internal model outputs),...
• SS26/15 (Solvency II: ORSA and the ultimate time horizon – non‑life firms) would be amended to clarify that the option to use IMO outputs in ORSA reporting applies only to firms still required to...
• The IM.03 reporting instructions (section “General Comment”) would be amended to align the reporting template guidance with the removal of Lloyd’s syndicates from IMO reporting, avoiding inconsistent...
• SS25/15 and SS26/15 would receive non‑substantive drafting updates to improve clarity and consistency, remove outdated EU references, and align terminology and framing with the PRA’s current Solvency...
• For 2026 year‑end, Lloyd’s syndicates would no longer be required to submit IMOs to the PRA, with supervisory reliance instead on other Solvency UK reporting streams and data provided through the...

Suggested Considerations

• Review existing IMO reporting processes and systems for Lloyd’s syndicates and prepare to decommission IMO submissions to the PRA for 2026 year‑end, ensuring all dependent internal reports and controls are updated.
• Map all uses of IMOs in ORSA processes and supervisory reporting for non‑life firms, and update ORSA documentation and methodologies to reflect that the IMO‑based option applies only to firms that remain in scope of IMO reporting.
• Update internal reporting manuals and instructions for IM.03 and related Solvency UK templates to reflect the revised PRA wording, removal of outdated EU references, and alignment with the PRA’s Solvency UK framework.
• For Lloyd’s managing agents and syndicates, confirm alternative data channels and reporting obligations to the PRA (via Lloyd’s or Solvency UK templates) that will replace the supervisory reliance previously placed on IMO reporting.
• Conduct an inventory of non‑UK covered bonds currently recognised as Level 2A HQLA in LCR calculations and assess how the proposed amendments to Article 11(1)(d)(ii) would change eligibility, haircuts, or caps from 1 January 2027.

Key Dates

References

• [1] bankofengland.co.uk/prudential-regulation/publication/202...
• [2] bankofengland.co.uk/prudential-regulation/publication/202...
• [3] bankofengland.co.uk/prudential-regulation/low-impact-amen...
• [4] kpmg.com/xx/en/our-insights/regulatory-insights/uk-regula...
• [5] bankofengland.co.uk/prudential-regulation/regulatory-dige...
• [6] bankofengland.co.uk/prudential-regulation/publication/202...
• [7] finreg.aoshearman.com/UK-PRA-consults-and-makes-low-impac...
• [8] media.milliman.com/v1/media/edge/images/millimaninc5660-m...

What Changed

• - Financial investment advisors must not conduct non‑guaranteed placement services (service de placement non garanti) such as actively seeking subscribers on behalf of issuers, unless they hold the...
• Firms that present themselves as independent advisors must not receive remuneration (direct or indirect) from product issuers whose instruments they recommend, unless permitted under MiFID II/French...
• When claiming independence, firms must provide accurate, clear and non‑misleading information on the nature of their independence, remuneration model, and any relationships with issuers or...
• Financial investment advisors must issue a written suitability statement formalising the investment advice provided, setting out the client’s profile, the recommended products, and the reasons why...
• Pre‑contractual documentation must include full information on costs, fees and remuneration, covering both the advised investment and any business introducer partners; omission of these disclosures...

Suggested Considerations

• Review the firm’s regulatory status (CIF versus investment services provider) and ensure that any placement or capital‑raising activities are within authorised limits; discontinue or re‑authorise any non‑guaranteed placement services currently carried out under CIF status.
• Conduct a comprehensive mapping of all services and activities (advisory, marketing, introductions, distribution) to confirm that none constitute regulated investment services (e.g., non‑guaranteed placement) without the requisite AMF/ACPR authorisation.
• Inventory all remuneration flows from issuers and third parties, including commissions, retrocessions and fees, and assess whether they are compatible with any independence claims and MiFID II inducements rules; remove or re‑label “independent” branding where issuer remuneration is received.
• Update client‑facing documentation (engagement letters, brochures, websites, emails) to provide clear, accurate and non‑misleading information on adviser independence, remuneration model, and any relationships with issuers or introducers.
• Implement or enhance procedures to ensure a written suitability statement is produced and delivered to clients for each piece of investment advice, documenting client profile, recommended products and rationale; integrate this into advisory workflows and record‑keeping.

Key Dates

References

• [1] amf-france.org/en/news-publications/news-releases/enforce...
• [2] amf-france.org/en/news-publications/news-releases/enforce...
• [3] amf-france.org/en/sujets/sanctions-settlements
• [4] amf-france.org/en/news-publications/publications/reports-...
• [5] financemagnates.com/forex/amf-fines-a-financial-investmen...
• [6] pideeco.be/regwatch/la-commission-des-sanctions-de-lamf-s...
• [7] amf-france.org/sites/institutionnel/files/pdf/56719/en/A_...
• [8] finascope.fr/english/communiques/

What Changed

• - Licensed corporations must ensure that firewall protection and network monitoring are implemented and effective across critical infrastructure, including file servers, domain controllers, email...
• Licensed corporations must maintain up‑to‑date operating systems and antivirus software, avoiding end‑of‑life or unpatched environments that materially increase vulnerability to ransomware and other...
• Firms must enforce strong user access and privileged account controls, including robust administration of system admin accounts, least‑privilege access models, periodic reviews of access rights, and...
• Firms must implement secure password management practices, prohibiting the storage of credentials in unencrypted files and enforcing strong password policies and technical controls for credential...
• Remote access must be subject to strict controls, including secure configuration of VPN or other remote access solutions, need‑to‑have access principles, and monitoring for unusual or unauthorized...

Suggested Considerations

• Conduct a comprehensive cybersecurity risk assessment and control gap analysis across all critical systems, including trading platforms, email servers, domain controllers, file servers, and accounting systems.
• Implement and regularly review firewall configurations and network monitoring tools to ensure effective protection and detection capabilities for internal and external network traffic.
• Upgrade all operating systems and antivirus software to supported, fully patched versions and establish formal patch and vulnerability management procedures with defined timelines and testing steps.
• Establish and enforce robust user access management policies, including least‑privilege access, periodic recertification of user and privileged accounts, and logging and monitoring of admin activities.
• Implement secure password management solutions and technical controls, eliminating unencrypted storage of credentials and enforcing strong password complexity, rotation, and multi‑factor authentication where applicable.

Key Dates

References

• [1] apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announce...
• [2] fxnewsgroup.com/tag/luk-fook/
• [3] apps.sfc.hk/edistributionWeb/api/circular/list-content/ci...
• [4] charltonslaw.com/legal/newsletters/574/sfc-enforcement-ac...
• [5] davispolk.com/insights/client-update/hong-kong-sfc-calls-...
• [6] apps.sfc.hk/edistributionWeb/gateway/EN/circular/intermed...
• [7] sfc.hk/-/media/EN/files/IS/publications/Cybersecurity-the...
• [8] reuters.com/legal/litigation/hong-kong-securities-regulat...