Investment Management

What Changed

• - Large associations, associations recognised as being of public utility and foundations are now subject to the accounting regime applicable to “medium‑sized undertakings” under the amended...
• Annual accounts for affected entities must include a non‑abridged balance sheet, a profit and loss account (at least in abridged format), and notes to the accounts containing disclosures required by...
• Affected entities must use statutory LRCS layouts for the balance sheet and profit and loss account and file their annual accounts in classic format with the Luxembourg Trade and Companies Register...
• Large associations, public‑utility associations and foundations remain exempt from the mandatory use of the Standard Chart of Accounts (Plan Comptable Normalisé – PCN) and from eCDF standard data...
• Affected entities may voluntarily adopt the PCN; if they do not adopt PCN, they must maintain an internal chart of accounts and ensure robust, documented mapping between internal accounts and...

Suggested Considerations

• Identify all Luxembourg associations, public‑utility associations and foundations within or related to the group that are impacted by the Law of 7 August 2023 and confirm their size classification (small, medium‑sized, large) and whether they fall under the “medium‑sized undertakings” regime.
• Review existing accounting policies, charts of accounts and annual accounts formats for affected entities to ensure alignment with LRCS statutory layouts, including non‑abridged balance sheet, appropriate profit and loss format, and required notes disclosures.
• Decide at governing‑body level whether each affected entity will voluntarily adopt the PCN or maintain an internal chart of accounts, documenting the rationale, governance approvals and compliance impacts of the chosen option.
• Where PCN is not adopted, design, implement and document a robust mapping from the internal chart of accounts to the statutory LRCS balance sheet and profit and loss layouts, ensuring audit‑ready documentation and traceability.
• Update accounting systems and reporting tools for affected entities to support LRCS statutory layouts, consistent layout adaptations, and classic‑format filing with the RCS, including necessary changes to interfaces and data capture.

Key Dates

References

• [1] cnc.lu/en/publication-of-qa-cnc-26-038/
• [2] linkedin.com/posts/stephane-schirrecker-6b52912_new-qa-cn...
• [3] cssf.lu/en/2026/06/cssf-communique-concerning-certain-cnc...
• [4] cssf.lu/en/
• [5] cnc.lu/en/publication-of-non-financial-information-and-di...
• [6] cssf.lu/wp-content/uploads/cssf18_698eng.pdf
• [7] cssf.lu/en/regulatory-framework-for-investment-fund-manag...
• [8] cssf.lu/en/2023/06/publication-of-qas-by-the-commission-d...

What Changed

• - Large not‑for‑profit associations, associations recognised as being of public utility and foundations are required to prepare annual accounting documents consisting at a minimum of annual accounts...
• These entities fall within the regime applicable to “medium‑sized undertakings”, which drives the required content and level of detail of their annual accounts (balance sheet, profit and loss account...
• The law and the CNC Q&A confirm that large associations, public‑utility associations and foundations are not legally required to use the Standard chart of accounts (Plan comptable normalisé, PCN) or...
• Although exempt from mandatory PCN use and eCDF standard data collection, these entities must still file their annual accounts with the Luxembourg Trade and Companies Register (RCS) using statutory...
• Large associations, public‑utility associations and foundations are exempt from the obligation to file the PCN trial balance (balance générale) via the eCDF platform, even though they may still...

Suggested Considerations

• Identify whether the organisation qualifies as a large association, an association recognised as being of public utility or a foundation under the Law of 7 August 2023, and document the classification decision with reference to Articles 18, 36 and 52 of that law.
• Update internal accounting policies to require annual accounts to be prepared in accordance with the regime for undertakings referred to in Article 47 LRCS, including minimum content (balance sheet, profit and loss account and notes) and disclosure requirements.
• Decide formally whether to adopt the PCN on a voluntary basis or to maintain an internal chart of accounts, and record this decision in accounting governance documents approved by the board or governing body.
• Where PCN is not adopted, design and implement a detailed and documented mapping from internal general ledger accounts to LRCS statutory balance sheet and profit and loss layouts to ensure accurate preparation and filing of annual accounts.
• Review and, where necessary, redesign annual accounts templates to comply with LRCS layouts while making only permitted adaptations (for example, titles and subtotals) that maintain clarity, comparability and consistency over time.

Key Dates

References

• [1] cnc.lu/en/publications/doctrine/qa-cnc-26-038-large-assoc...
• [2] cnc.lu/en/publication-of-qa-cnc-26-038/
• [3] cnc.lu/publications/doctrine/qa-cnc-26-038-grandes-associ...
• [4] cnc.lu/publication-du-qa-cnc-26-038/
• [5] cssf.lu/en/
• [6] linkedin.com/posts/stephane-schirrecker-6b52912_new-qa-cn...
• [7] cssf.lu/en/2026/06/cssf-communique-concerning-certain-cnc...
• [8] cssf.lu/en/publication-data/

What Changed

• - The Supplemental Guidance formally sets out the circumstances and general principles the CBI’s Prohibition Decision Maker will consider when deciding whether to impose a Prohibition Notice,...
• The guidance clarifies the decision-making framework for the nature, scope and duration of a prohibition, including whether it applies to specific controlled functions (CFs), parts of CFs, or any...
• The guidance codifies how a Prohibition Notice becomes effective, establishing that effectiveness arises either through a written agreement between the CBI and the individual concerned (prohibition...
• The guidance explains the three mechanisms by which a Prohibition Notice may be terminated or cease to have effect: (1) termination of a prohibition agreement by the CBI, (2) revocation of a...
• The Supplemental Guidance sets out CBI’s approach to requests by prohibited persons to terminate a prohibition agreement, including the factors CBI will assess when considering whether to lift or...

Suggested Considerations

• Update Fitness and Probity policies, procedures, and governance frameworks to explicitly address the possibility of Prohibition Notices, including criteria for escalation, internal investigation standards, record‑keeping, and engagement protocols with the CBI during prohibition-related processes.
• Ensure Board and senior management, including PCF role holders and HR/legal/compliance leads, are briefed on the new prohibition guidance, the publication policy, and the enhanced transparency of outcomes so that they understand the personal and organisational consequences of F&P failings.
• Strengthen documentation and retention of supervisory, disciplinary, compliance and performance records for CF and PCF holders to ensure that, if a prohibition is contemplated, the firm can provide a coherent, contemporaneous factual record to the CBI and the individual.
• Review and, where necessary, amend individual accountability frameworks (including Statements of Responsibilities and role profiles) to clearly delineate responsibilities, seniority and CF scope, given that these factors now explicitly influence the nature, scope and duration of any prohibition.
• Embed procedures to manage individuals who become subject to proposed or actual Prohibition Notices, including immediate role restrictions, notification workflows, communication protocols to boards and key stakeholders, and contingency planning for business continuity.

Key Dates

References

• [1] centralbank.ie/regulation/how-we-regulate/fitness-probity
• [2] centralbank.ie/docs/default-source/regulation/how-we-regu...
• [3] centralbank.ie/docs/default-source/regulation/how-we-regu...
• [4] centralbank.ie/regulation/how-we-regulate/fitness-probity...
• [5] cgi.org.uk/membership/branches-regions/ireland/agenda/iri...
• [6] maples.com/wp-content/uploads/2025/04/Central-Bank-of-Ire...
• [7] centralbank.ie/docs/default-source/regulation/how-we-regu...
• [8] maples.com/knowledge/updates-to-the-irish-fitness-and-pro...

What Changed

• - Issuers domiciled in Germany with securities admitted to trading on an organised market in Germany must publish an announcement (“Hinweisbekanntmachung”) specifying the exact date and internet...
• The announcement on annual financial information must be published no later than four months after the end of each financial year and must be issued before the first public availability of the...
• Annual financial information must be made publicly available on the internet in addition to its disclosure in the Company Register (Unternehmensregister), and the announcement obligation relates...
• Issuers must publish a half‑yearly financial report no later than three months after the end of each reporting period.
• Failure to publish financial reports or the required announcements, or failure to do so within the prescribed periods, constitutes a contravention of the WpHG and exposes the issuer to administrative...

Suggested Considerations

• Map all WpHG‑related periodic reporting obligations (annual, half‑yearly, and any interim or ad‑hoc requirements) into a documented compliance calendar with responsible owners and system reminders well ahead of statutory deadlines.
• Implement a formal procedure to prepare, approve, and publish “Hinweisbekanntmachungen” that clearly specify the date and internet address of annual financial information, ensuring publication before the first public availability of the annual report and within four months of financial year‑end.
• Establish controls to guarantee that annual financial information is published both in the Company Register and on the issuer’s website, and that these publications are synchronised with the required announcements.
• Design and enforce a process for producing and publishing half‑yearly financial reports within three months after the end of each reporting period, including clear timelines for drafting, audit/review (where relevant), management approval, and technical website publication.
• Conduct a gap analysis of current financial reporting and disclosure procedures against WpHG requirements to identify any missing steps, unclear responsibilities, or weaknesses in escalation mechanisms for imminent deadline breaches.

Key Dates

References

• [1] bafin.de/SharedDocs/Veroeffentlichungen/DE/Massnahmen/40c...
• [2] bafin.de/SharedDocs/Downloads/DE/Angebotsunterlage/Leo_In...
• [3] bafin.de/EN/home_node_en.html
• [4] northdata.com/Leo%20International%20Precision%20Health%20...
• [5] finanznachrichten.de/nachrichten-2026-03/68026196-leo-int...
• [6] globenewswire.com/news-release/2026/05/22/3300302/0/en/le...
• [7] globenewswire.com/news-release/2026/06/12/3311244/0/en/le...

What Changed

• - Financial investment advisors must not conduct non‑guaranteed placement services (service de placement non garanti) such as actively seeking subscribers on behalf of issuers, unless they hold the...
• Firms that present themselves as independent advisors must not receive remuneration (direct or indirect) from product issuers whose instruments they recommend, unless permitted under MiFID II/French...
• When claiming independence, firms must provide accurate, clear and non‑misleading information on the nature of their independence, remuneration model, and any relationships with issuers or...
• Financial investment advisors must issue a written suitability statement formalising the investment advice provided, setting out the client’s profile, the recommended products, and the reasons why...
• Pre‑contractual documentation must include full information on costs, fees and remuneration, covering both the advised investment and any business introducer partners; omission of these disclosures...

Suggested Considerations

• Review the firm’s regulatory status (CIF versus investment services provider) and ensure that any placement or capital‑raising activities are within authorised limits; discontinue or re‑authorise any non‑guaranteed placement services currently carried out under CIF status.
• Conduct a comprehensive mapping of all services and activities (advisory, marketing, introductions, distribution) to confirm that none constitute regulated investment services (e.g., non‑guaranteed placement) without the requisite AMF/ACPR authorisation.
• Inventory all remuneration flows from issuers and third parties, including commissions, retrocessions and fees, and assess whether they are compatible with any independence claims and MiFID II inducements rules; remove or re‑label “independent” branding where issuer remuneration is received.
• Update client‑facing documentation (engagement letters, brochures, websites, emails) to provide clear, accurate and non‑misleading information on adviser independence, remuneration model, and any relationships with issuers or introducers.
• Implement or enhance procedures to ensure a written suitability statement is produced and delivered to clients for each piece of investment advice, documenting client profile, recommended products and rationale; integrate this into advisory workflows and record‑keeping.

Key Dates

References

• [1] amf-france.org/en/news-publications/news-releases/enforce...
• [2] amf-france.org/en/news-publications/news-releases/enforce...
• [3] amf-france.org/en/sujets/sanctions-settlements
• [4] amf-france.org/en/news-publications/publications/reports-...
• [5] financemagnates.com/forex/amf-fines-a-financial-investmen...
• [6] pideeco.be/regwatch/la-commission-des-sanctions-de-lamf-s...
• [7] amf-france.org/sites/institutionnel/files/pdf/56719/en/A_...
• [8] finascope.fr/english/communiques/

What Changed

• - Licensed corporations must ensure that firewall protection and network monitoring are implemented and effective across critical infrastructure, including file servers, domain controllers, email...
• Licensed corporations must maintain up‑to‑date operating systems and antivirus software, avoiding end‑of‑life or unpatched environments that materially increase vulnerability to ransomware and other...
• Firms must enforce strong user access and privileged account controls, including robust administration of system admin accounts, least‑privilege access models, periodic reviews of access rights, and...
• Firms must implement secure password management practices, prohibiting the storage of credentials in unencrypted files and enforcing strong password policies and technical controls for credential...
• Remote access must be subject to strict controls, including secure configuration of VPN or other remote access solutions, need‑to‑have access principles, and monitoring for unusual or unauthorized...

Suggested Considerations

• Conduct a comprehensive cybersecurity risk assessment and control gap analysis across all critical systems, including trading platforms, email servers, domain controllers, file servers, and accounting systems.
• Implement and regularly review firewall configurations and network monitoring tools to ensure effective protection and detection capabilities for internal and external network traffic.
• Upgrade all operating systems and antivirus software to supported, fully patched versions and establish formal patch and vulnerability management procedures with defined timelines and testing steps.
• Establish and enforce robust user access management policies, including least‑privilege access, periodic recertification of user and privileged accounts, and logging and monitoring of admin activities.
• Implement secure password management solutions and technical controls, eliminating unencrypted storage of credentials and enforcing strong password complexity, rotation, and multi‑factor authentication where applicable.

Key Dates

References

• [1] apps.sfc.hk/edistributionWeb/gateway/EN/news-and-announce...
• [2] fxnewsgroup.com/tag/luk-fook/
• [3] apps.sfc.hk/edistributionWeb/api/circular/list-content/ci...
• [4] charltonslaw.com/legal/newsletters/574/sfc-enforcement-ac...
• [5] davispolk.com/insights/client-update/hong-kong-sfc-calls-...
• [6] apps.sfc.hk/edistributionWeb/gateway/EN/circular/intermed...
• [7] sfc.hk/-/media/EN/files/IS/publications/Cybersecurity-the...
• [8] reuters.com/legal/litigation/hong-kong-securities-regulat...

What Changed

• - Asset managers must maintain and apply documented procedures and controls to identify whether proposed private fund arrangements or transactions are dubious, including where structures are...
• Where a proposed arrangement or transaction is assessed as dubious, asset managers may only proceed once they are satisfied that concerns and red flags have been sufficiently addressed and evidenced.
• Fund managers are expected to exercise independent investment discretion and cannot rely solely on investor‑driven proposals, especially from influential client personnel such as chief investment...
• Asset managers must ensure that all fund investments comply with the fund’s stated investment restrictions and align with its stated investment objectives, with documented controls to verify...
• Firms must implement effective measures to identify, manage, and continuously monitor the risks to which private funds are exposed, including counterparty, concentration, structural, and...

Suggested Considerations

• Review and update private fund governance frameworks to ensure investment approvals require independent investment discretion, documented due diligence, and explicit challenge of investor‑driven proposals, particularly those originating from client senior management.
• Implement or enhance written procedures to identify “dubious arrangements”, including criteria such as unnecessary structural complexity, unclear commercial rationale, additional costs or risks, related‑party exposure, and potential concealment of asset movements or connected transactions.
• Establish a mandatory escalation and approval process for complex or investor‑driven transactions, requiring risk, compliance, and senior management sign‑off before execution and documented reasoning for proceeding.
• Conduct a gap analysis of all existing private funds to confirm that current and past investments comply with the funds’ investment restrictions and stated objectives, and remediate any breaches including client notification and corrective actions where appropriate.
• Strengthen risk management frameworks for private funds by defining key risk types, setting monitoring thresholds, and implementing periodic risk reporting to senior management and the board.

Key Dates

References

• [1] caproasia.com/2023/08/24/hong-kong-sfc-fines-china-indust...
• [2] sfc.hk/en/Regulatory-functions/Enforcement/Disciplinary-p...
• [3] sfc.hk/-/media/EN/files/COM/Reports/Enforcement-Reporter_...

What Changed

• (Strictly speaking this is an enforcement case rather than a rule change, but it effectively clarifies regulatory expectations and evidences enforcement priorities.)
• Licensed corporations must treat discrepancies between a client’s declared financial profile and purported asset holdings as material red flags, triggering enhanced KYC,...
• Firms must independently verify documents purportedly issued by other brokers, especially when used as proof of holdings for sell orders, and must not rely on such documents at face value when they...
• Licensed corporations are expected to apply risk-based AML/CFT controls to securities sell orders where there is a risk that the client may not beneficially own the assets, or where forged/false...
• Firms must report suspected fraudulent or deceptive conduct by clients to the SFC (and, where applicable, to JFIU) without delay, even where the misconduct appears confined to a single transaction or...

Suggested Considerations

• Review and update client onboarding procedures to ensure that inconsistencies between clients’ declared financial profiles and claimed asset holdings are systematically identified, documented, and escalated for enhanced due diligence before any orders are executed.
• Implement controls requiring independent verification (e.g. direct confirmation or reliable third‑party checks) of statements and documents purportedly issued by other brokers when these are used to evidence holdings for sell orders.
• Update AML/CFT policies and procedures under AMLO and the SFC Guideline on Anti-Money Laundering and Counter-Financing of Terrorism (For Licensed Corporations) to explicitly cover handling of suspected forged documents and false information supplied by clients.
• Establish or reinforce a formal process for promptly reporting suspected fraudulent, deceptive, or market abusive conduct by clients to the SFC, and where appropriate to JFIU, including clear internal thresholds, escalation paths, and record‑keeping.
• Conduct a gap analysis of existing red flag indicators to ensure they cover situations where the size or nature of client holdings is incommensurate with the client’s stated income, net worth, occupation, or overall risk profile.

Key Dates

References

• [1] webb-site.com/codocs/SFC060328.pdf
• [2] kucoin.com/news/flash/hong-kong-sfc-fines-victory-securit...
• [3] sfc.hk/en/Regulatory-functions/Enforcement/Disciplinary-p...
• [4] www1.hkexnews.hk/listedco/listconews/gem/2018/0716/gln201...
• [5] sfc.hk/-/media/EN/files/COM/QR-Reports/202110-12/2eEnforc...
• [6] chinadailyhk.com/hk/article/353041
• [7] sfc.hk/-/media/EN/files/COM/Reports/Enforcement-Reporter_...

What Changed

• - The AMF’s decision reinforces that asset managers must maintain continuous compliance with their authorisation conditions, but isolated overreach by a person not listed as an executive officer was...
• Firms must have procedures that identify and manage conflicts of interest, including conflicts arising from links with a parent company and from the overlapping functions of directors and financial...
• Asset managers must ensure continuity of human resources and align remuneration practices for financial managers with the applicable regulations, the approved programme of activity, and internal...
• Firms must disclose to investors management-fee retrocessions paid to distributors and must be able to justify any claimed enhancement of the service provided.
• Information provided to investors and prospects must be clear, accurate, and not misleading, including in marketing materials.

Suggested Considerations

• Review the firm’s authorisation file, governance map, and executive-officer appointments to confirm that actual decision-making powers match the AMF-approved organisational structure.
• Update conflicts-of-interest procedures to capture conflicts arising from parent-company relationships, cross-directorships, and shared finance leadership roles.
• Test whether staffing levels and succession arrangements ensure continuity of human resources for control functions and key operational roles.
• Reassess remuneration arrangements for financial managers to verify consistency with the firm’s programme of activity, internal procedures, and regulatory requirements.
• Verify that all distributor retrocessions are fully disclosed to investors and that any claim of enhanced service is documented with evidence.

Key Dates

References

• [1] amf-france.org/en/news-publications/news-releases/enforce...
• [2] amf-france.org/sites/institutionnel/files/pdf/77659/en/Th...
• [3] finascope.fr/english/reglementation/la-commission-des-san...
• [4] kroll.com/en/publications/financial-compliance-regulation...
• [5] kroll.com/en/insights/publications/financial-compliance-r...
• [6] amf-france.org/en/news-publications/news-releases/enforce...
• [7] opalesque.com/712766/AMF_ruling_underscores_personal_acco...
• [8] navacelle.law/historical-sanctions-financial-markets-auth...

What Changed

• - The Central Bank of Ireland has formally identified “Bates Finance Limited (CLONE)” as an unauthorised investment firm / investment business firm and published its details (name, website, email,...
• The warning explicitly states that Bates Finance Limited (CLONE) is not authorised to provide investment services in Ireland and is cloning an authorised firm’s details to pass itself off as...
• The Central Bank confirms that there is no connection between the legitimate authorised firm and the cloned entity using its name.
• The firm’s name is published under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, reaffirming the Central Bank’s enforcement power to publicly name unauthorised providers.
• The warning reiterates channels for reporting suspected unauthorised firms to the Central Bank (telephone and online reporting), reinforcing expectations that firms and individuals will escalate...

Suggested Considerations

• Monitor the Central Bank of Ireland’s unauthorised firms and warning notices on an ongoing basis and promptly update internal watchlists, sanctions‑style lists, and fraud‑monitoring tools to include Bates Finance Limited (CLONE).
• Update customer‑facing communications, scam warnings, and investor education materials to reference clone firms and instruct clients to verify authorisation using the Central Bank’s Registers before engaging with any investment firm.
• Review and strengthen controls for detecting and responding to clone firm activity, including monitoring for misuse of the firm’s name, logo, Companies Registration Office number, or website domain in Ireland and other jurisdictions.
• Implement procedures to immediately escalate to the Central Bank and law enforcement (e.g. An Garda Síochána) if the firm becomes aware that its identity is being cloned or if clients are approached by Bates Finance Limited (CLONE) or similar unauthorised entities.
• Enhance due‑diligence and onboarding checks to validate counterparties and intermediaries offering investment products into Ireland, ensuring they hold appropriate authorisation from the Central Bank or relevant EU/EEA regulators.

Key Dates

References

• [1] centralbank.ie/regulation/how-we-regulate/authorisation/u...
• [2] centralbank.ie/regulation/how-we-regulate/authorisation/u...
• [3] centralbank.ie/news/article/warning-notice-service-financ...
• [4] service.betterregulation.com/document/30388
• [5] registers.centralbank.ie/downloadspage.aspx
• [6] fca.org.uk/news/warnings/bates-finance-clone-uk-registere...
• [7] eu-fpg.com/resources/jurisdictions/ireland
• [8] centralbank.ie/news/article/warning-notice-central-bank-o...

What Changed

• - The Central Bank of Ireland has formally designated “Russell Administration Limited (CLONE)” as an unauthorised investment firm under section 53 of the Central Bank (Supervision and Enforcement)...
• The warning confirms that Russell Administration Limited (CLONE) is not authorised to provide investment services in Ireland, and that there is no connection between this clone entity and the...
• The Central Bank has publicly disclosed specific identifiers for the unauthorised firm (website, email address, and phone number) to assist firms and consumers in recognising and blocking fraudulent...
• The notice reiterates that firms and individuals can report suspected unauthorised or clone firms directly to the Central Bank via designated telephone contact points.
• By publishing the warning, the Central Bank reinforces its policy that operating as an investment firm in Ireland without appropriate authorisation is unlawful and subject to supervisory and...

Suggested Considerations

• Verify that your firm’s name, contact details, and regulatory authorisation information have not been cloned or misused by Russell Administration Limited (CLONE) or other similar entities, and escalate any evidence of impersonation to the Central Bank and local law enforcement.
• Update client-facing communications, including website fraud alerts and investor letters, to warn about clone firms and specifically list known identifiers (such as the Russell Administration Limited (CLONE) website, email address, and phone number) where relevant to your client base.
• Instruct front-office, call centre, and relationship management staff to advise clients to check the Central Bank Registers and unauthorised firms list before engaging with any entity claiming to be regulated in Ireland, and to report any suspicious contact immediately.
• Review and strengthen internal financial crime and fraud detection controls to include explicit screening for clone firm indicators, such as mismatched contact details, unregistered domains, and requests to transfer funds to newly introduced counterparties.
• Incorporate the Russell Administration Limited (CLONE) warning and similar Central Bank warning notices into your firm’s ongoing financial crime risk assessments and customer risk profiling, particularly for high-risk investment products and cross-border services.

Key Dates

References

• [1] centralbank.ie/regulation/how-we-regulate/authorisation/u...
• [2] service.betterregulation.com/document/30388
• [3] centralbank.ie/regulation/industry-market-sectors/securit...
• [4] fi.ee/sites/default/files/2025-08/Loan%20365%20(Clone)%20...
• [5] linkedin.com/posts/central-bank-of-ireland_central-bank-o...
• [6] registers.centralbank.ie
• [7] edit.centralbank.ie/docs/default-source/publications/fina...

What Changed

• - BaFin reiterates that shareholders must notify both the issuer and BaFin when their voting rights in an issuer reach, exceed, or fall below specified thresholds, in line with sections 33 et seq.
• The publication confirms that the notification must be made within four trading days from the triggering event (i.e. crossing of a relevant voting rights threshold).
• BaFin highlights that failure to notify, or to notify within the prescribed four‑trading‑day period, constitutes an administrative offence under the WpHG.
• The notice confirms that BaFin can impose administrative fines on natural persons for breaches of the voting rights notification obligation up to a statutory maximum of €2 million.
• The case illustrates BaFin’s willingness to impose multiple fines for multiple notification failures arising from separate threshold crossings or reporting obligations within a given period.

Suggested Considerations

• Map all shareholdings in German‑listed issuers (including derivatives and instruments conferring voting rights) against the WpHG notification thresholds and maintain a central register of current and potential reportable positions.
• Implement or enhance automated monitoring tools and internal controls to detect in real time when voting rights in a German‑listed issuer are about to reach, exceed, or fall below a threshold, triggering a four‑trading‑day notification period.
• Establish a clear, documented procedure for preparing and submitting voting rights notifications to both the issuer and BaFin, including responsible owners, escalation paths, and backup arrangements for absences or system outages.
• Review and update internal policies, shareholder disclosure manuals, and client onboarding documentation to explicitly reflect the four‑trading‑day deadline and the requirement to notify both the issuer and BaFin when thresholds are crossed.
• Train front‑office, trading, corporate actions, and legal/compliance staff (including those outside Germany) on German voting rights notification rules, focusing on threshold levels, calculation principles (including aggregation across entities and instruments), and timelines.

Key Dates

References

• [1] bafin.de/SharedDocs/Veroeffentlichungen/EN/Massnahmen/40c...
• [2] bafin.de/EN/Aufsicht/BoersenMaerkte/Emittentenleitfaden/M...
• [3] bafin.de/SharedDocs/Veroeffentlichungen/EN/Massnahmen/40c...
• [4] bafin.de/EN/Aufsicht/BoersenMaerkte/Emittentenleitfaden/M...
• [5] solutions-atlantic.com/germany-bafin-sets-fine-for-substa...
• [6] bafin.de/SharedDocs/Veroeffentlichungen/EN/Fachartikel/20...
• [7] noerr.com/en/insights/payment-service-providers'-reportin...
• [8] resourcehub.bakermckenzie.com/en/resources/cloud-complian...

What Changed

• - Credit institutions and investment firms are no longer permitted to accept payments, fees, commissions or non‑monetary benefits from third parties (e.g.
• The prohibition applies to the forwarding of both retail and professional client orders and covers any form of economic benefit linked to routing orders to a specific counterparty or venue.
• Germany’s previous use of the MiFIR national exemption for domestic clients has ended; there is no longer any national carve‑out for PFOF in relation to clients resident or established in Germany.
• BaFin’s supervisory statement specifies how firms must interpret and apply the EU‑level PFOF ban in practice, including alignment with ESMA’s interpretative decisions on the scope of prohibited...
• The stated regulatory objective is to improve the quality of client order execution and prevent conflicts of interest arising from execution venues or market makers incentivising brokers to route...

Suggested Considerations

• Identify and map all current remuneration streams linked to order routing, including explicit PFOF arrangements, volume‑based rebates, and other benefits from market makers or venues, and cease any arrangements that constitute PFOF or similar third‑party inducements for forwarding orders.
• Review and update MiFID II / MiFIR inducement policies to explicitly classify PFOF and similar execution‑related rebates as prohibited benefits, ensuring no reliance on inducement disclosure or quality‑enhancement arguments to justify them.
• Amend best‑execution policies and procedures to remove any consideration of third‑party payments from venues or market makers in the execution‑venue selection process and to emphasise price, cost, speed, likelihood of execution, and other MiFID II best‑execution factors.
• Conduct a conflicts‑of‑interest assessment to identify any residual incentives or arrangements that could compromise the duty to act in the best interests of clients in order routing, and implement mitigation measures or remove such conflicts where necessary.
• Redesign pricing and revenue models for neobroker and low‑fee brokerage services to replace PFOF‑funded “zero‑commission” offerings with compliant alternatives, such as explicit commissions, spreads, subscription fees, or other transparent charges.

Key Dates

References

• [1] lrz.legal/de/lrz/eu-regulierung-von-neubrokern
• [2] bafin.de/SharedDocs/Veroeffentlichungen/DE/Aufsichtsmitte...
• [3] asscompact.de/nachrichten/bafin-positioniert-sich-zum-ges...
• [4] neuebanken.de/pfof-verbot-2026-neobroker/
• [5] onvista.de/news/2025/12-29-bye-bye-payment-for-order-flow...
• [6] dasinvestment.com/bafin-will-neobrokern-auf-den-zahn-fueh...
• [7] dasinvestment.com/payment-for-orderflow-verbot-neobroker-...
• [8] boersen-zeitung.de/english/neobrokers-brace-for-end-of-pa...

What Changed

• - The CBI has formally commissioned an independent review of its enforcement activities, covering both how enforcement is structured and how it operates in practice, rather than a narrow thematic or...
• The review mandate expressly covers the performance of enforcement activities and the role of enforcement within the wider supervisory framework, indicating that enforcement may be repositioned...
• The review will examine enforcement structures and processes, including decision‑making governance, which may result in new approval routes, escalation paths, or committee structures for opening,...
• The review will look at case‑selection criteria and processes, suggesting potential future changes to how and why firms or individuals are selected for enforcement action, and possibly the...
• Timeliness of enforcement actions is in scope, which may lead to explicit timelines or service standards for case progression, investigation milestones, and resolution, with potential knock‑on...

Suggested Considerations

• Review and document your enforcement‑facing governance, including Board and senior management oversight of investigations, decision‑making on settlement, and escalation paths, to ensure these are robust and can withstand a more structured or time‑bound enforcement approach.
• Assess whether your record‑keeping, data, and management information relating to regulatory breaches, incidents, and CBI interactions are sufficiently complete and organised to support faster and more transparent enforcement processes.
• Conduct a gap analysis of investigation procedures and response playbooks (e.g. dawn raid readiness, information requests, interviews, internal investigations) to ensure they can meet potentially tighter CBI timeliness and information‑quality expectations.
• Update Board and senior management on the launch of the enforcement review and agree a watching brief, including designation of a responsible function (e.g. Compliance or Legal) to monitor the review, its terms of reference, stakeholder engagements and eventual recommendations.
• Engage external counsel or industry associations, as appropriate, to prepare for possible consultation or stakeholder engagement opportunities during the review, including developing key messages on proportionality, timeliness, transparency and coordination with supervision.

Key Dates

References

• [1] bis.org/review/r180124b.pdf
• [2] kpmglaw.ie/pdf/ie-fitness-and-probity-august-2024.pdf
• [3] irishtimes.com/business/2024/07/11/central-bank-vetting-r...
• [4] oireachtas.ie/en/debates/debate/dail/2011-10-25/31/
• [5] lexology.com/library/detail.aspx?g=af4e0d93-8179-4ffd-9af...

What Changed

• - The SEC has formally announced that Principal Deputy Director of the Division of Enforcement Sam Waldon will leave the agency effective 31 July 2026, ending more than 14 years of service at the SEC.
• The Enforcement Division will have a new Principal Deputy Director (named in the release), who will assume responsibility for overseeing day‑to‑day enforcement operations, supervision of regional and...
• Waldon’s departure follows his recent tenure as Acting Director and Principal Deputy Director during a period of strategic restructuring of the Enforcement Division, including creation of multiple...
• The transition occurs against the backdrop of earlier Commission decisions to rescind delegation of formal order authority to the Enforcement Director, returning formal order approvals to the...
• Under Waldon’s leadership, the Division emphasized “quality over quantity” cases, focusing on traditional “core” areas (insider trading, accounting and disclosure fraud, market manipulation,...

Suggested Considerations

• Review and update enforcement‑risk assessments to reflect the forthcoming change in SEC Enforcement Division Principal Deputy Director, with particular focus on core fraud, insider trading, and accounting‑related risks.
• Re‑evaluate internal investigation, Wells process, and SEC engagement protocols to ensure they align with current Enforcement Manual practices and anticipate any refinements under the new Principal Deputy Director.
• Brief senior management, boards, and audit committees on the SEC enforcement leadership transition and its implications for prioritization of accounting, disclosure, and gatekeeper cases, particularly in light of the SOX‑focused enforcement unit.
• Reassess crypto and digital asset exposure, including ongoing or threatened SEC matters, to account for potential shifts in enforcement posture under new leadership while maintaining preparedness for fraud‑focused actions involving retail investors.
• Reinforce insider trading surveillance, market‑abuse monitoring, and controls around material non‑public information, reflecting the Enforcement Division’s continued emphasis on traditional trading‑related misconduct.

Key Dates

References

• [1] bloomberg.com/news/articles/2026-03-20/sec-lays-out-polic...
• [2] sec.gov/newsroom/press-releases/2024-162
• [3] angelinvestorsnetwork.com/regulatory-compliance/sec-enfor...
• [4] sec.gov/newsroom/press-releases/2026-27-sec-announces-enf...
• [5] reuters.com/world/us/sec-focus-traditional-cases-under-ne...
• [6] hklaw.com/en/insights/publications/2026/04/sec-speaks-are...
• [7] morganlewis.com/pubs/2026/04/securities-enforcement-round...
• [8] ainvest.com/news/sec-enforcement-inflection-point-directo...

What Changed

• - BaFin has formally confirmed an enforcement action where late or missing voting rights notifications under sections 33 et seq.
• The publication reiterates that shareholders must notify both the issuer and BaFin within four trading days when their voting rights reach, exceed, or fall below certain statutory thresholds in...
• BaFin explicitly links failures to notify or late notifications to administrative offences under the WpHG, with potential fines for legal persons of up to €10 million or up to 5% of total turnover,...
• The communication reflects BaFin’s continued focus on the proper functioning and attractiveness of EU capital markets, framing voting rights notification compliance as a core transparency tool rather...
• The case signals that BaFin is prepared to sanction non‑German firms (such as US‑based Brown Capital Management LLC) when their holdings in German issuers trigger WpHG thresholds and the resulting...

Suggested Considerations

• Map all portfolios and mandates to identify direct and indirect holdings of shares and related instruments in German issuers subject to WpHG voting rights notification rules.
• Implement or enhance an automated monitoring tool that aggregates positions at group level (including funds, managed accounts and derivatives) and flags when WpHG thresholds are approached or crossed.
• Review and document internal procedures to ensure that notifications to affected issuers and to BaFin are drafted, approved and submitted within the four‑trading‑day statutory deadline.
• Ensure that legal and compliance teams fully understand the WpHG threshold framework (including initial thresholds and subsequent incremental thresholds, and attribution rules) and maintain up‑to‑date written guidance and checklists.
• Establish a clear allocation of responsibilities between portfolio management, trading, operations, legal and compliance for detecting threshold crossings and preparing notification forms.

Key Dates

References

• [1] bafin.de/SharedDocs/Veroeffentlichungen/DE/Massnahmen/40c...
• [2] fxnewsgroup.com/forex-news/regulatory/bafin-fines-brown-c...
• [3] bafin.de/EN/Aufsicht/BoersenMaerkte/Emittentenleitfaden/M...
• [4] bafin.de/EN/home_node_en.html
• [5] bafin.de/SharedDocs/Veroeffentlichungen/EN/Massnahmen/40c...
• [6] bafin.de/SharedDocs/Veroeffentlichungen/EN/Fachartikel/20...
• [7] fintrx.com/firms/firm/brown-capital-management-llc-105633

What Changed

• - ESMA is explicitly positioned as the central supervisory authority for selected capital‑markets activities, with national competent authorities (NCAs) expected to operate within a more formalised...
• Supervisory objectives are reframed towards risk‑based and adaptive supervision, meaning firms should expect more differentiated supervisory intensity based on risk profile, business model, and...
• The paper supports proportionate and transparent funding for ESMA, indicating a future where firms may be subject to EU‑level supervisory levies or fee structures in addition to national regimes,...
• AFM and AMF call for independent, transparent, and accountable EU‑level supervisory governance, foreshadowing changes to ESMA’s decision‑making bodies, oversight processes, and accountability...
• Data centralisation is identified as a core enabler, implying a stronger move towards EU‑wide data hubs, harmonised reporting formats, and central access for ESMA to transaction, position, and...

Suggested Considerations

• Review and update the firm’s supervisory engagement strategy to include structured, proactive engagement with ESMA (not just NCAs), anticipating more direct interactions, thematic reviews, and data requests at EU level.
• Assess current risk‑assessment and risk‑reporting frameworks to ensure they are compatible with a risk‑based and adaptive supervisory approach, including the ability to demonstrate how your firm identifies, measures, and mitigates emerging risks and new business models.
• Conduct a gap analysis of data architecture and regulatory reporting, focusing on data quality, standardisation, and ability to feed into centralised EU data hubs; plan upgrades to systems, controls, and data governance to support ESMA‑level data centralisation.
• Prepare for potential changes in supervisory levies and funding, by modelling the impact of EU‑level ESMA fees in addition to national contributions and incorporating them into medium‑term budgeting and pricing strategies.
• Review governance arrangements, including board oversight, senior management responsibilities, and internal escalation processes, to ensure they can meet higher expectations of independent, transparent, and accountable governance under an ESMA‑centric model.

Key Dates

References

• [1] afm.nl/en/sector/themas/over-het-toezicht-en-beleid-van-d...
• [2] amf-france.org/sites/institutionnel/files/private/2025-01...
• [3] amf-france.org/sites/institutionnel/files/private/2025-01...
• [4] afm.nl/~/profmedia/files/publicaties/2021/position-paper-...
• [5] amf-france.org/en/news-publications/amfs-eu-positions/fre...
• [6] loyensloeff.com/insights/news--events/news/looking-ahead-...
• [7] elibrary.imf.org/downloadpdf/view/journals/002/2011/204/a...
• [8] regulationtomorrow.com/2026/01/afm-publishes-supervisory-...

What Changed

• As the 21 July 2026 CSSF notice is an enforcement publication (not a new rule), it does not introduce new regulatory requirements; it applies existing Transparency Law obligations.
• Issuers with Luxembourg as home Member State under the Transparency Law must publish annual financial reports within the statutory deadline, typically within four months of financial year-end, and...
• Failure to publish periodic financial information within the required time limits can result in administrative fines imposed by the CSSF under Article 25(2) of the Transparency Law.
• The CSSF will publicly disclose administrative fines imposed on issuers, including naming the issuer and the amount, in line with Article 26b of the Transparency Law.
• Issuers retain the right to challenge CSSF decisions before the Luxembourg Administrative Court within the period set by Article 27 of the Transparency Law (three months from notification), but...

Suggested Considerations

• Map all Transparency Law obligations applicable to your entity, including periodic (annual and half‑yearly) reporting and ongoing disclosure of regulated information, and document them in a compliance obligations register.
• Review and, where necessary, strengthen internal processes to ensure annual and half‑yearly financial reports are prepared, approved, and published within statutory deadlines for issuers with Luxembourg as home Member State.
• Implement a formal disclosure governance framework assigning clear responsibilities to senior management and the board for oversight of regulated information, including escalation procedures where delays or issues arise.
• Establish a calendar of regulatory reporting and publication deadlines, including internal cut‑off dates and contingency plans, and ensure it is monitored by compliance and finance functions.
• Conduct a gap analysis of prior disclosures (financial reports, major holdings notifications, inside information) to confirm that all items required under the Transparency Law have been published correctly and on time; remediate any deficiencies promptly.

Key Dates

References

• [1] offshorealert.com/transnet-soc-ltd-e15k-fine/
• [2] opensanctions.org/entities/NK-YGvBVghMpKt3CGHYCGfn2N/
• [3] cssf.lu/wp-content/uploads/S_31_TRA_151121_en.pdf
• [4] iol.co.za/news/south-africa/2026-07-09-transnet-blacklist...
• [5] cssf.lu/wp-content/uploads/S_17_PSF_SP_JTC-Luxembourg-S.A...
• [6] siu.org.za/special-tribunal-freezes-r20-3-million-in-asse...
• [7] centralbank.ie/regulation/how-we-regulate/international-f...
• [8] cssf.lu/wp-content/uploads/FAQ_International_financial_sa...

What Changed

• - Article 8 funds must describe how the investment strategy actually enables the fund to meet the environmental and/or social characteristics disclosed to investors.
• If an Article 8 fund relies mainly on an exclusion strategy, the CSSF expects the exclusion policy to be detailed enough for investors to understand how the stated characteristics are being met.
• Article 9 funds cannot rely only on an exclusion strategy; they must invest in sustainable investments and use a positive selection process that demonstrates alignment with Article 2(17) SFDR.
• For Article 9 funds, the CSSF expects sustainable-investment status to be maintained at all times, including on an ongoing basis during the life cycle of the fund.
• Financial market participants should make available the methodology used to determine whether an investment is a sustainable investment, including any thresholds used for a pass-fail approach.

Suggested Considerations

• Review all Article 8 pre-contractual disclosures to confirm that the stated investment strategy clearly explains how the fund’s environmental or social characteristics are achieved.
• Strengthen any Article 8 exclusion-based strategy disclosures so they provide sufficient detail for investors to understand the connection between exclusions and the claimed sustainability characteristics.
• Reassess all Article 9 product classifications to confirm that the portfolio is built around qualifying sustainable investments, not only exclusions.
• Implement controls to verify that Article 9 holdings remain aligned with Article 2(17) SFDR on an ongoing basis throughout the fund lifecycle.
• Document and retain the internal methodology used to assess sustainable-investment status, including any thresholds, and ensure it can be provided to investors or supervisors upon request.

Key Dates

References

• [1] cssf.lu/wp-content/uploads/FAQ-SFDR.pdf
• [2] bsp.lu/lu/publications/newsletters-newsflashes/new-cssf-f...
• [3] debevoise.com/-/media/files/pdf/faq_sfdr.pdf?rev=85b95600...
• [4] maples.com/knowledge/cssf-updates-sfdr-faq
• [5] elvingerhoss.lu/insights/publications/sustainable-finance...
• [6] cms.law/en/lux/legal-updates/CSSF-FAQ-on-Cross-Border-Dis...
• [7] mondaq.com/pdf/1362226.pdf
• [8] cms.law/en/content/download/739359/file/From%202025%20to%...

What Changed

• - ESMA reports that NCAs have strengthened authorisation assessments by placing greater emphasis on firms’ cross-border business plans and intentions before granting or maintaining permissions.
• NCAs are increasingly using data-driven and risk-based supervision to monitor cross-border activity and calibrate supervisory attention to the scale, nature, and complexity of the activity.
• NCAs have expanded cooperation and enforcement, including more targeted supervisory actions and reporting of enforcement cases where relevant.
• ESMA expects NCAs with significant outbound cross-border activity to ensure that their supervisory and enforcement approaches are proportionate to the level of risk and business volume.
• The report reinforces that cross-border activity should be treated as a distinct supervisory risk area, not merely as an incidental extension of domestic supervision.

Suggested Considerations

• Review cross-border business plans for all passported investment services and ensure they are supported by clear governance, staffing, systems, and client-service arrangements.
• Map all outbound cross-border activities by jurisdiction, client type, product type, and distribution channel so that compliance can identify where supervisory risk is highest.
• Strengthen controls over retail cross-border activity, including marketing, suitability/appropriateness, complaints handling, and local conduct requirements in each host market.
• Prepare to provide supervisors with more granular evidence of how cross-border risks are identified, monitored, escalated, and mitigated.
• Ensure internal reporting can distinguish cross-border revenue, complaints, incidents, and enforcement exposure from domestic business lines.

Key Dates

References

• [1] esma.europa.eu/sites/default/files/2026-07/ESMA42-2004696...
• [2] esma.europa.eu/press-news/esma-news/esma-finds-shortcomin...
• [3] esma.europa.eu/sites/default/files/2025-10/ESMA22-5075148...
• [4] esma.europa.eu/sites/default/files/2025-12/ESMA35-3354356...
• [5] esma.europa.eu/sites/default/files/2026-06/ESMA22-5075148...
• [6] schoenherr.eu/content/to-the-point-financial-regulation-1...
• [7] esma.europa.eu/press-news/esma-news/esma-publishes-report...
• [8] esma.europa.eu/sites/default/files/library/esma42-111-553...

What Changed

• - The UN sanctions committee amended the list of sanctioned individuals, companies, and organizations relating to the Democratic Republic of Congo on 16 July 2026.
• The change is directly applicable in Switzerland, so firms cannot wait for a separate Swiss implementing act before acting on the updated list.
• SECO updated the Swiss sanctions database SESAM on 17 July 2026 and published the update on its website.
• Financial intermediaries must implement the prohibitions set out in the ordinance, including freezing the assets of sanctioned persons.
• Financial intermediaries must report the affected business relationships to SECO.

Suggested Considerations

• Review sanctions screening results immediately against the updated Congo-related list in SESAM and any internal watchlists to identify matching clients, counterparties, and beneficial owners.
• Freeze assets and block prohibited dealings involving newly designated persons, companies, or organizations as required by the ordinance.
• Report affected business relationships to SECO in line with the sanctions ordinance requirements.
• Perform enhanced internal clarifications under Article 6 GwG/AMLA whenever a sanctions hit or other red flags create suspicion.
• File an immediate suspicious activity report with the Money Laundering Reporting Office under Article 9 GwG/AMLA if doubts cannot be resolved.

Key Dates

References

• [1] finma.ch/de/news/2026/07/20260720-sr-946-231-12/
• [2] eda.admin.ch/en/newnsb/KbHRHJgit-lofkgs08y9Q
• [3] uvek.admin.ch/de/newnsb/KbHRHJgit-lofkgs08y9Q
• [4] admin.ch/fr/newnsb/KbHRHJgit-lofkgs08y9Q
• [5] un.org/german/de/media/16079
• [6] fiu.gov.ai/financial-and-targeted-sanctions/sanction-notices
• [7] gov.im/news/2026/jul/17/sanctions-lists-update-democratic...
• [8] ch.marketscreener.com/boerse-nachrichten/un-verhaengen-sa...

What Changed

• * The AMF advocates removal of many existing “Member State options” in SRD in order to achieve greater harmonisation of shareholder rights and issuer–shareholder interactions across the EU, reducing...
• The AMF reiterates that long‑term shareholder engagement should remain a core objective of the revised SRD and that the framework should explicitly facilitate ongoing dialogue between issuers and...
• The AMF supports the development of hybrid general meetings with real‑time remote voting as a structural feature of EU listed company governance, in line with the digitalisation of the economy and...
• The AMF considers “closed‑door” general meetings (with no in‑person or remote shareholder participation) to be incompatible with SRD objectives and proposes that such formats be prohibited in the...
• The AMF proposes that “virtual‑only” general meetings should remain possible but be subject to tighter regulation at EU level, including a requirement to obtain shareholders’ approval on a regular...

Suggested Considerations

• Monitor the European Commission’s SRD review process closely, including the forthcoming legislative proposal and any related impact assessments, as these will determine concrete new obligations on meeting formats, shareholder identification and intermediaries’ duties.
• Map current practices for general meetings (physical, hybrid, virtual‑only) against the AMF’s positions and SRD II requirements, and assess the extent to which existing procedures depend on national options or flexibilities that may be removed in a revised SRD.
• For intermediaries and custodians, assess existing cross‑border voting, information transmission and shareholder identification processes to identify areas of fragmentation or reliance on local practices that may be affected by EU‑level harmonisation.
• Engage with industry associations and local regulators to provide practical feedback on operational challenges (e.g. complex custody chains, vote confirmation, cut‑off times) so that future SRD revisions reflect realistic implementation constraints.
• Update internal regulatory change logs and risk assessments to flag the SRD review as an emerging structural change to shareholder‑rights processes, with potential impacts on IT systems, contracts with intermediaries, and investor communications.

Key Dates

References

• [1] amf-france.org/fr/actualites-publications/positions-ue-de...
• [2] amf-france.org/en/news-publications/news/amf-encourages-f...
• [3] societegenerale.lu/fileadmin/user_upload/sgss_regulatory_...
• [4] ici.org/system/files/2026-05/2605-cl-ec-consultation-on-s...

What Changed

• - BaFin has explicitly treated a material cyberattack on a listed software company as *inside information* that must be disclosed without delay under Article 17(1) MAR.
• The decision confirms that failure to publish inside information “as soon as possible” constitutes a contravention of subparagraph 1 of Article 17(1) MAR and is subject to administrative fines.
• BaFin reiterates that issuers based in Germany with securities traded on an organised market in Germany are subject to an ad hoc disclosure obligation for inside information.
• BaFin highlights that inside information includes precise, non-public information directly or indirectly relating to an issuer or its instruments, which would likely have a significant price effect...
• The enforcement action illustrates BaFin’s willingness to use its full MAR toolkit on disclosure failures, with potential maximum fines of €2.5 million or up to 2% of total revenue for similar...

Suggested Considerations

• Conduct an immediate review of incident classification frameworks to ensure that significant cyberattacks are systematically assessed for MAR “inside information” criteria, including likely price impact.
• Update ad hoc disclosure policies and procedures to explicitly cover cyber incidents, including clear triggers, escalation paths, and decision-making timelines for potential MAR disclosures.
• Implement or enhance cross-functional incident response governance so that Security / IT, Legal, Compliance and Investor Relations jointly evaluate cyber events for ad hoc disclosure obligations.
• Review and, where necessary, revise Board and senior management training to cover MAR Article 17 obligations in the context of cyber incidents and operational disruptions.
• Test existing “ad hoc announcement” workflows (including drafting, approval and publication mechanisms) to confirm the firm can publish inside information on cyberattacks “as soon as possible” in practice, including outside normal business hours.

Key Dates

References

• [1] fxnewsgroup.com/forex-news/regulatory/germanys-federal-fi...
• [2] bafin.de/EN/home_node_en.html
• [3] ba-fin.net/DieBaFin/Service/MVPportal/Verdacht_MAR/verdac...
• [4] fxnewsgroup.com/category/forex-news/regulatory/
• [5] wallstreet-online.de/nachricht/20896242-eqs-pvr-teamviewe...
• [6] teamviewer.com/en-us/legal/imprint/

What Changed

• - The CBI has formally listed Aoncfd (CLONE) as an unauthorised investment firm / investment business firm that is not permitted to provide investment services or operate as an investment firm in...
• The CBI has publicly identified Aoncfd (CLONE)’s websites, email address, and purported Dublin address to support monitoring and blocking efforts by firms and market infrastructures.
• The CBI has clarified that Aoncfd (CLONE) is a clone entity that has copied the name, address and foreign registration details (CONSOB Registration 5141) of Aon Solutions Ireland Limited, and that...
• The publication reiterates that the CBI will use its section 53 naming power under the Central Bank (Supervision and Enforcement) Act 2013 to publicly warn about unauthorised firms.
• The notice reinforces existing expectations that firms, consumers, and intermediaries should use the CBI’s authorisations register and list of unauthorised firms as part of fraud and clone‑risk...

Suggested Considerations

• Firms should immediately screen client referral sources, onboarding records, and any existing or prospective relationships against the identifiers published for Aoncfd (CLONE) (names, URLs, email, and purported address) and block or terminate any exposure.
• Compliance teams should update internal fraud and financial crime watchlists and sanctions‑style screening tools to include Aoncfd (CLONE) and the specific URLs, email address and address cited in the warning.
• Authorised firms, particularly Aon Solutions Ireland Limited, should conduct brand‑misuse and impersonation checks (including web‑scraping, social media monitoring and domain surveillance) to identify further clone activity and prepare incident‑response plans.
• Client‑facing staff should be briefed via targeted compliance communications to warn clients about clone firms and to ensure they direct clients to the CBI’s register and unauthorised firms list when verifying any investment provider claiming an Irish authorisation.
• Firms should review and, where necessary, enhance KYC and onboarding controls to include explicit verification of a counterparty’s regulatory authorisation in Ireland (or relevant jurisdiction) and checks for inconsistencies between provided details and registry information.

Key Dates

References

• [1] centralbank.ie/news/article/fti-finance-limited-(clone)--...
• [2] fi.ee/sites/default/files/2023-02/CENTRA~2.PDF
• [3] finanstilsynet.no/contentassets/4bd8bb48debc4989af4e599b1...

What Changed

• - Regulation E‑Delivery would formally replace the SEC’s decades‑old, purely guidance‑based approach to electronic delivery and establish a rule‑based framework that expressly permits e‑delivery to...
• Electronic delivery would become the default method of delivery, meaning firms could deliver required regulatory information electronically without first obtaining the investor’s affirmative consent,...
• The rule would preserve investor choice by requiring that investors and other recipients be able to request paper delivery at any time and continue receiving paper format upon request.
• The proposal would set out requirements and conditions for when e‑delivery is deemed compliant, including use of electronic addresses or other electronic methods reasonably designed to ensure receipt...
• The range of deliverable documents under Regulation E‑Delivery would be broad, covering prospectuses for funds and other issuers, fund annual and semi‑annual shareholder reports, proxy statements,...

Suggested Considerations

• Conduct a comprehensive mapping of all documents currently delivered under federal securities law requirements (prospectuses, shareholder reports, proxy materials, trade confirmations, Form CRS, Form ADV brochures) and determine how each will be delivered under Regulation E‑Delivery.
• Review and update disclosure, investor communication and delivery policies to incorporate e‑delivery as the default method while clearly documenting investor rights to request and receive paper delivery at any time.
• Design and implement procedures for maintaining accurate electronic contact information for investors and clients, including periodic verification processes and remediation steps for undeliverable emails or failed electronic transmissions.
• Develop and operationalize the transition process for paper‑based recipients, including generation and mailing of the two required paper notices that explain the move to e‑delivery and the opt‑out option.
• Update client and investor onboarding materials, account agreements and preference‑capture workflows to reflect the new default e‑delivery model and how investors can elect paper delivery or change their preferences.

Key Dates

References

• [1] reginfo.gov/public/do/eAgendaViewRule?pubId=202510&RIN=32...
• [2] morganlewis.com/blogs/finreg/2023/04/an-end-to-the-paper-...
• [3] sec.gov/rules-regulations/2000/04/use-electronic-media
• [4] sec.gov/files/rules/proposed/2023/33-11176.pdf
• [5] sec.gov/comments/s7-09-20/s70920-8210190-227541.pdf
• [6] finra.org/media-center/blog/facilitating-e-delivery-while...
• [7] planadviser.com/white-house-to-review-sec-electronic-deli...
• [8] klgates.com/Click-Here-for-Your-Fund-Report-SEC-Endorses-...

What Changed

• - Regulation (EU) 2024/2809 amends elements of the Prospectus Regulation, and those amendments fully took effect on 5 June 2026.
• The Prospectus Regulation continues to apply as the core EU framework for prospectuses, with the CBI acting as the competent authority in Ireland for approval matters.
• The CBI states that it must decide on a prospectus application within 90 working days of receipt of the initial application, or 100 working days for an SME.
• If the review exceeds the applicable working-day limit, the CBI will cease reviewing the prospectus without approving it and will notify the issuer, offeror, or person seeking admission to trading.
• A one-off extension of 30 working days may be requested before the original 90 working-day period lapses, including for SMEs.

Suggested Considerations

• Review all prospectus templates, disclosure checklists, and approval workflows against the amended Prospectus Regulation provisions that became fully applicable on 5 June 2026.
• Reassess transaction timetables to ensure the planned filing date allows for the 90 working day or 100 working day CBI review window, plus any needed extension request.
• Submit any request for a one-off 30 working day extension before the original approval period expires, and include the required reference details in the request.
• Confirm whether any current or planned issuance qualifies as an SME transaction, because the approval deadline differs from the standard timetable.
• Update internal sign-off procedures so legal, finance, and compliance teams can demonstrate that prospectus materials are prepared in line with the CBI’s statutory mandate and the amended EU framework.

Key Dates

References

• [1] centralbank.ie/regulation/industry-market-sectors/securit...
• [2] centralbank.ie/regulation/industry-market-sectors/securit...
• [3] lexology.com/library/detail.aspx?g=3a44879f-3ddb-4233-974...
• [4] byrnewallaceshields.com/news-and-recent-work/publications...
• [5] irishstatutebook.ie/eli/2022/si/135/made/en/print
• [6] irishstatutebook.ie/eli/2019/si/380/made/en/pdf
• [7] williamfry.com/wp-content/uploads/2023/10/Securities-Regu...

What Changed

• Because the visible page content provided is limited to technical and cookie‑related information, the key points below focus on the regulatory substance of the CSSF MiFID II/MiFIR FAQ (Q&A) as the...
• The CSSF confirms the application of MiFID II investor protection rules to Luxembourg investment service providers, including obligations on inducements, suitability, product governance, and best...
• The FAQ reiterates that investment services providers must inform clients clearly whether their investment advice or services are provided on an independent or non‑independent basis, and explains the...
• The FAQ clarifies that inducements are expressly prohibited when investment advice is provided on an independent basis and for portfolio management services, requiring firms to structure their...
• The CSSF guidance reflects product governance obligations: manufacturers must define a target market for each financial instrument based on clients’ knowledge and experience, financial situation,...

Suggested Considerations

• Review the latest CSSF MiFID II/MiFIR FAQ (13 July 2026 version) in full, comparing it against existing internal MiFID II/MiFIR policies, procedures, and controls to identify gaps or misalignments.
• Confirm and, where necessary, update client‑facing disclosures to clearly state whether investment services (especially advice and portfolio management) are provided on an independent or non‑independent basis, and ensure that inducement arrangements are consistent with this classification.
• Reassess inducement frameworks (commissions, fees, non‑monetary benefits) for investment advice and portfolio management to ensure that no prohibited inducements are received or retained where services are independent or involve portfolio management.
• Review and update product governance frameworks, including target market definition processes and product approval procedures, to ensure that each instrument’s intended target market is properly documented and consistently used by distributors.
• Examine best execution policies to confirm they are clear, detailed, and understandable to clients, and implement or enhance ongoing monitoring mechanisms (e.g. execution quality reports, periodic reviews) to evidence compliance with best execution obligations.

Key Dates

References

• [1] cssf.lu/wp-content/uploads/QA-MiFIDII_MiFIR.pdf
• [2] cssf.lu/en/Document/cssf-faq-mifid-ii-mifir/
• [3] cssf.lu/en/mifid-ii-priips/
• [4] cssf.lu/fr/mifid-ii-priips/
• [5] nortonrosefulbright.com/en/knowledge/publications/494a828...
• [6] esma.europa.eu/sites/default/files/library/esma35-43-349_...

What Changed

• - ESMA added a Q&A clarifying consulting activities to investors or undertakings under the EU ESG Ratings Regulation (ESGRR), which is relevant where a ratings provider’s advisory services may...
• ESMA added Q&As on the application and scope of the two working day notification period under ESGRR, indicating that firms must apply the notification clock consistently and in line with ESMA’s...
• ESMA clarified access to the dataset for factual error review under ESGRR, which affects how rated entities or issuers can review underlying data used in ESG ratings processes.
• ESMA added a Q&A on notifications without a designated contact under ESGRR, which is relevant for governance and outreach workflows when a notification lacks an identified recipient.
• ESMA clarified the obligation to consider issuer feedback under ESGRR, reinforcing that issuer comments cannot be ignored and must be handled through a documented review process.

Suggested Considerations

• Review ESG ratings policies to ensure consulting, notification, issuer feedback, and factual error review procedures align with ESMA’s latest ESGRR Q&As.
• Update internal case-handling workflows so notifications are screened for the designated contact issue and the two-working-day notification period is calculated consistently.
• Document how your firm distinguishes internal-use ESG ratings or in-house financial services from externally provided ESG ratings activity.
• Reassess whether any second-party opinion business can rely on the ESGRR exemption and record the legal basis for that conclusion.
• Re-map MiCA permissions for custody, administration, transfer, and lending services to confirm the firm is not performing activities outside its authorisation scope.

Key Dates

References

• [1] aima.org/article/esma-publishes-fourth-package-of-mifir-l...
• [2] esma.europa.eu/press-news/esma-news/new-qas-available-may...
• [3] esma.europa.eu/press-news/esma-news/new-qas-available-15
• [4] esma.europa.eu/esmas-activities/digital-finance-and-innov...
• [5] esma.europa.eu/publications-and-data/questions-answers
• [6] regulationtomorrow.com/2026/06/esma-public-statement-on-e...
• [7] service.betterregulation.com/document/827391
• [8] lexisnexis.com/en-gb/legal/news/eu-financial-services-dai...

What Changed

• - The FAQs now provide targeted guidance for public‑private partnership (P3) market participants on when their activities in structuring or advising on P3 financings constitute municipal advisory...
• The FAQs clarify for Form MA and Form MA‑I filers which remote work locations where municipal advisor‑related business is conducted must be disclosed as an “office,” affecting how firms classify and...
• The FAQs add staff views on the scope of recordkeeping requirements when a municipal advisor provides advice on the pricing of a new issue of municipal securities, reinforcing obligations under...
• A new FAQ explains how to register as a municipal advisor, directing prospective advisors (including sole proprietors) to an existing SEC staff Informational Bulletin and MSRB compliance resource...
• The SEC reiterates that the final municipal advisor registration rules adopted in 2013 remain in force and emphasizes that firms and individuals conducting municipal advisory activity should “come...

Suggested Considerations

• Conduct a comprehensive assessment of public‑private partnership activities to determine whether any structuring, advisory, or financing work for state or local governments involves “municipal advisory activities” that trigger SEC municipal advisor registration requirements.
• Review all current and planned municipal advisory activities (including indirect advice through third‑party professionals) against the SEC’s municipal advisor definition, exclusions, and exemptions, and document registration determinations in a formal internal memo.
• Identify all locations, including employees’ remote and home offices, where municipal advisor‑related business is conducted, and update Form MA and Form MA‑I filings to ensure accurate disclosure of “offices” according to the new FAQ guidance.
• Review and, where necessary, update books‑and‑records policies and procedures to ensure that advice on pricing of new issues of municipal securities is fully captured, including communications, analyses, models, and recommendations, in line with SEC and MSRB recordkeeping standards.
• Establish or update onboarding and change‑management controls to ensure that new municipal advisory lines of business, new P3 mandates, or expansions into remote work arrangements are reviewed by compliance for municipal advisor registration and office‑reporting implications before launch.

Key Dates

References

• [1] newsfilecorp.com/release/304771/SEC-Office-of-Municipal-S...
• [2] sec.gov/newsroom/press-releases/2023-56
• [3] sec.gov/newsroom/whats-new/registration-municipal-advisor...
• [4] katten.com/SEC-Issues-Proposed-Rules-Requiring-Registrati...
• [5] sec.gov/about/divisions-offices/office-municipal-securiti...
• [6] msrb.org/Rules-and-Interpretations/MSRB-Rules
• [7] regcompliancewatch.com/sec-releases-faqs-on-municipal-adv...
• [8] msrb.org/Registering-MSRB

What Changed

• - The Central Bank of Ireland has formally designated “MacKay Shields UK LLP (CLONE)” as an unauthorised investment firm / investment business firm / alternative investment fund manager and published...
• The notice clarifies that MacKay Shields UK LLP (CLONE) is not authorised to provide investment services, investment business services or AIFM services in Ireland and therefore any financial services...
• The Central Bank highlights that the clone firm has been offering fake investments via the applications NYLI and NYLIPLUS, emphasising a specific scam vector via investment apps rather than...
• The warning confirms that the clone firm has cloned the name and registration details of the legitimate MacKay Shields UK LLP (Central Bank register C121665), reinforcing the pattern of...
• The firm’s name is being published under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, signalling that the Central Bank considers the activity sufficiently serious to warrant...

Suggested Considerations

• Review and update client‑facing communications, website content and FAQs to warn clients about clone‑firm risks, specifically referencing messaging‑app contact details and investment apps such as NYLI and NYLIPLUS that are not associated with authorised firms.
• Implement or enhance procedures within AML / financial crime and fraud‑risk frameworks to identify and escalate interactions involving the listed email address (support@mackay-shields.email) and the specified WhatsApp and telephone numbers, treating them as indicators of potential scam activity.
• Instruct front‑office, client‑relationship and call‑centre staff to verify authorisation status using the Central Bank’s public registers before acknowledging or forwarding any investment proposals that reference “MacKay Shields UK LLP” or similar branding.
• Notify internal legal and regulatory affairs teams, and where relevant the legitimate MacKay Shields UK LLP, of the clone warning to coordinate responses, client communications and potential reporting of any attempted impersonation or fraudulent use of the authorised firm’s details.
• Review existing third‑party distribution and referral arrangements to ensure counterparties are not using or promoting NYLI, NYLIPLUS or similar unregulated applications, and add contractual provisions requiring immediate notification if cloning or impersonation is suspected.

Key Dates

References

• [1] finanstilsynet.no/contentassets/1f99db27d4004b4198e3a44d1...
• [2] centralbank.ie/news/article/larl-f.s.---larl-financial-se...
• [3] centralbank.ie/news/article/apel-investments-(clone)---ce...
• [4] centralbank.ie/news/article/fti-finance-limited-(clone)--...
• [5] fca.org.uk/news/warnings/bwb-ireland-investment-managemen...
• [6] breakingnews.ie/business/central-bank-has-issued-almost-1...
• [7] linkedin.com/posts/compliance-institute_warning-notices-t...
• [8] irishtimes.com/business/financial-services/central-bank-i...

What Changed

• - The CBI has formally designated AGF International Advisors Company Limited (CLONE) and/or Iron-Cap / IRONCAP as an unauthorised investment firm / investment business firm and has published its...
• The specific websites www.iron-cap.com and https://www.iron-cap.io (including the French-language path https://www.iron-cap.io/fr/forgot-password/) have been identified as associated with this...
• The email addresses support@iron-cap.com and Samuel.breval@iron-cap.com have been flagged as being used by the unauthorised entity in connection with the Iron-Cap / IRONCAP investment offering.
• The CBI has reiterated that the clone is not authorised to provide investment services or investment business services in Ireland and has explicitly clarified that there is no connection whatsoever...
• The warning reinforces existing CBI expectations that Irish‑authorised firms and gatekeepers must monitor and respond to clone‑firm activity, including by reporting suspected unauthorised firms...

Suggested Considerations

• Review and update client‑onboarding procedures to include specific screening for the websites www.iron-cap.com and https://www.iron-cap.io and the email domains associated with Iron-Cap / IRONCAP, flagging and escalating any matches as suspected clone‑firm exposure.
• Update sanctions, fraud, and financial crime screening tools and internal watchlists to include the unauthorised firm identifiers associated with AGF International Advisors Company Limited (CLONE) and Iron-Cap / IRONCAP, ensuring alerts are generated for relevant customer or transaction hits.
• Strengthen fraud‑awareness communications to clients and staff by referencing the CBI’s financial scam materials, emphasising the risks of dealing with unauthorised firms and clone entities, and advising clients to verify firm authorisation before investing.
• Establish or update an internal escalation protocol for suspected clone‑firm activity, ensuring that all such cases are reported promptly to the CBI via the dedicated unauthorised firms reporting channels and, where applicable, to other relevant regulators.

Key Dates

References

• [1] centralbank.ie/news/article/press-release-warning-agf-(cl...
• [2] centralbank.ie/news/article/apel-investments-(clone)---ce...
• [3] cnmv.es/webservices/verdocumento/ver?e=25B0Uu3r5m6GcxD3cP...
• [4] fca.org.uk/news/warnings/agf-europe-advisors-clone
• [5] finanstilsynet.no/contentassets/94a5c72015a5407391c9f7eee...
• [6] centralbank.ie/news-media/warning-notices/56
• [7] cnmv.es/webservices/verdocumento/ver?e=sDwq3fSYKAJr8phF8P...
• [8] fi.ee/et/print/pdf/node/48614

What Changed

• - The CBI has formally designated Arbionis as an unauthorised investment firm and published its details (name, website, phone number) as a warning notice on its website.
• The CBI has clarified that Arbionis is not authorised to provide investment services in Ireland, meaning it cannot lawfully carry out regulated investment activities in or into Ireland.
• The name Arbionis has been published under section 53 of the Central Bank (Supervision and Enforcement) Act 2013, confirming this is part of the CBI’s supervisory and enforcement toolkit against...
• The warning reiterates that market participants and the public should use the CBI’s channels (telephone line and online reporting tool) to report suspected unauthorised firms or persons.
• The CBI re‑emphasises its consumer‑protection messaging, directing individuals and firms to its dedicated financial scams information page, thereby underlining expectations that firms proactively...

Suggested Considerations

• Screen all existing and prospective counterparties, introducers, and investment product providers against the CBI unauthorised firms list, and update internal watchlists to include Arbionis and its known identifiers (name, website, phone number).
• Prohibit onboarding Arbionis as a counterparty, intermediary, or service provider and ensure no marketing, introduction, or distribution arrangements exist or are entered into with this firm.
• Conduct an immediate review of client transaction flows and communications to identify any exposure to Arbionis, including referrals, introductions, payments, or client queries referencing Arbionis or its website.
• If any exposure to Arbionis is identified, escalate to compliance and legal functions, assess potential consumer detriment, and consider notifying the Central Bank of Ireland via the dedicated phone number or online reporting channel.
• Enhance client‑facing communications and website content to warn clients about unauthorised investment firms, referencing the CBI’s financial scams guidance and explaining how clients can verify authorisation status.

Key Dates

References

• [1] centralbank.ie/news/article/alliancebernstein-limited-(cl...
• [2] rte.ie/news/business/2021/1222/1268177-central-bank-warning/
• [3] centralbank.ie/news/article/beinfinity-clone----central-b...
• [4] centralbank.ie/news/article/warning-notice-lioniseassets-...
• [5] centralbank.ie/regulation/how-we-regulate/authorisation/u...
• [6] cnmv.es/webservices/verdocumento/ver?e=x8hCs+c9Bo88couiGD...
• [7] fi.ee/sites/default/files/2024-08/Guardian%20Invest%20-%2...
• [8] irishtimes.com/business/financial-services/central-bank-i...